News for hackers. Stuff that matters.
Re:Netflix now supports TLS 1.3 by daurnimator on Tuesday April 21, 2020 @07:02AM (#22933793)
Also to prevent traffic shaping: ISPs throttle traffic that contains netflix.com in the SNI. ESNI (encrypted SNI) comes with TLS 1.3.
Re:Netflix now supports TLS 1.3 by georgyo on Tuesday April 21, 2020 @07:20AM (#22933874)
ESNI was dropped from the TLS1.3 spec. It is currently a draft protocol.

Almost nothing supports ESNI yet. Chrome does not have it yet. Firefox does but it very difficult to enable, there is a config flag but it does nothing on its own unless you also enable DNS over HTTP in Firefox.

OpenSSL has no support for ESNI yet either.

ESNI also never tells the user if it is working or not yet, making downgrades fairly easy.

ESNI is a long way from being deployed, let alone useful.

Re:Netflix now supports TLS 1.3 by moduspol on Tuesday April 21, 2020 @07:58AM (#22934100)
They're Netflix, though, so they've got a lot of use cases where they control both ends of the connection (e.g. they've got a native app for the end user). If it's important to them to have ESNI support, they presumably could do it for those use cases.
Re:Netflix now supports TLS 1.3 by middleclick on Tuesday April 21, 2020 @08:07AM (#22934163)
CloudFlare has ESNI enabled (and so do websites hosted by it, like medium.com) so it's not as if no one is doing it.
Re:Netflix now supports TLS 1.3 by georgyo on Tuesday April 21, 2020 @08:15AM (#22934215)
If no clients support it, and you can't tell as a user if it is working, then effectively no one is using it.
Re:Netflix now supports TLS 1.3 by shawnz on Tuesday April 21, 2020 @09:43AM (#22934893)
Firefox supports it, although currently only as a configurable.

Users can test their ESNI support online here: https://www.cloudflare.com/ssl/encrypted-sni/

Re:Netflix now supports TLS 1.3 by georgyo on Tuesday April 21, 2020 @10:30AM (#22935238)
It is enabled and working in _my_ firefox.

But, I encourage you to try to get it working in _your_ firefox, where that site says you are in fact using ESNI. It is trickier than just enabling a flag.

If you think this means people are using it, sure. Firefox has ~9% of market share, and a very small percent (maybe 0.1%) of those users have correctly configured this, and when those users visit a page hosted by cloudflare they will may be use ESNI. That is in fact more than zero users. It is a very very small number today, but hopefully it will grow in the future.

And while that page you link tests ESNI, I cannot verify that any other domain supports ESNI. I am unaware of any tooling that lets me test that today.

Re:Netflix now supports TLS 1.3 by berti on Tuesday April 21, 2020 @09:05PM (#22941004)
> Firefox supports it

Only if you use their built-in DoH resolver. The public keys for ESNI are distributed by DNS records and as I understand it there's a bunch of work to be done for Firefox to retrieve these records from classic DNS servers. That work has been classified P5 (we won't do it, but might accept patches)[0].

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1500289

Re:Netflix now supports TLS 1.3 by middleclick on Tuesday April 21, 2020 @09:43AM (#22934890)
Firefox supports it and Chrome has plans to support it in the future. I agree that it's not much right now but it's a start.
Re:Netflix now supports TLS 1.3 by cheschire on Tuesday April 21, 2020 @07:07AM (#22933813)
Ah, the good ol' radar detector reflector.

There was a skit I saw a couple decades ago where a person was showing off his radar detector, then in order to combat that, the police had developed a radar detector reflector, so then he had made a radar detector reflector protector or something like that, then they made a protector detector, and so on. It was a couple minutes of explaining his best efforts to counter the police counters to his counters and on and on. But, you know, funny.

Re:Netflix now supports TLS 1.3 by tbrock on Tuesday April 21, 2020 @07:25AM (#22933913)
You’re probably thinking of the movie “the big hit”. It’s trace busters: https://m.youtube.com/watch?v=Iw3G80bplTg

The trace busta busta busta.

Re:Netflix now supports TLS 1.3 by v7p1Qbt1im on Tuesday April 21, 2020 @07:15AM (#22933854)
Networking noob here. Can‘t the ISP see Netflix‘s ASN/commonly used IP‘s and shape that way?
Re:Netflix now supports TLS 1.3 by gsnedders on Tuesday April 21, 2020 @07:24AM (#22933902)
Yes. The case where it's much more useful is traffic going in/out of major CDNs to shared IP addresses. For Netflix or someone else running their own CDN the gains are much smaller.
Re:Netflix now supports TLS 1.3 by MaxBarraclough on Tuesday April 21, 2020 @07:34AM (#22933962)
So ISPs could still impose traffic shaping on Netflix if they wanted to, I take it? I can't see how Netflix could prevent this. Ultimately, their servers ('OCAs') have easily detectable IP addresses, right?
Re:Netflix now supports TLS 1.3 by throwaway287391 on Tuesday April 21, 2020 @07:55AM (#22934087)
Fast.com probably helps quite a bit. If ISPs throttle Netflix' traffic their fast.com measurements will look bad and customers will complain/sue. (AFAIK there's no way to distinguish between fast.com tests and actual Netflix video consumption since the former's traffic patterns are identical(?) to a Netflix video streaming client's.)

Creating fast.com always seemed like a pretty brilliant move by Netflix to me.

Re:Netflix now supports TLS 1.3 by Tijdreiziger on Tuesday April 21, 2020 @08:13AM (#22934193)
I think that was the whole point of fast.com, right? Speeds to known 'speedtest' servers were manipulated by ISPs, and this was bad for Netflix's business because customers would ostensibly have good speeds yet have slow Netflix, so fast.com was created as a way to measure the 'real' speed to Netflix's servers.
Re:Netflix now supports TLS 1.3 by throwaway287391 on Tuesday April 21, 2020 @12:26PM (#22936432)
Yeah, that's what I was saying (or at least trying to say).
Re:Netflix now supports TLS 1.3 by MaxBarraclough on Tuesday April 21, 2020 @07:58AM (#22934103)
Good point. Smaller players can't make the same move though.
Re:Netflix now supports TLS 1.3 by lclarkmichalek on Wednesday April 22, 2020 @05:32AM (#22943753)
Both the replies here miss the fact that the relationship between Netflix and ISPs is often pretty cooperative. Specifically, Netflix will provide ISPs with devices to do caching. The ISPs need to install and run these devices, configure the routes to send traffic to them, etc etc. Details: https://openconnect.netflix.com/en/. Because of that (and various other things), it's very easy for ISPs to attribute traffic to Netflix.
Re:Netflix now supports TLS 1.3 by daurnimator on Tuesday April 21, 2020 @08:53AM (#22934484)
IIRC netflix mostly use AWS these days. So checking IPs will just check for anything AWS hosted.
Re:Netflix now supports TLS 1.3 by profmonocle on Tuesday April 21, 2020 @09:06AM (#22934583)
For the web site and UI, yes. But the actual video traffic comes from a private CDN: https://openconnect.netflix.com