Background: Website fingerprinting is a class of techniques used to identify which websites a user is visiting through an encrypted tunnel, such as a VPN or Tor. A common setting involves an attacker that monitors the link between the user’s device and the tunnel’s entry point, collects the encrypted traffic, and determines which website the encrypted communication contents correspond to via classification models. This works because the traffic, despite encryption, contains certain patterns that characterize the underlying web page. Certain defenses are based on the idea that these patterns can be changed and rendered unidentifiable by sending padding packets that do not carry any of the actual data the web browser needs to display the web page. These are called padding-only defenses.
Description: The paper is a critique of the widely held assumption that padding-only defenses don’t cause delay in web traffic and that users therefore don’t have to wait longer for web pages to load, something that must be avoided because its negative effects on user experience result in lower adoption of defense techniques. We run experiments using the Shadow network simulator to show that padding-only defenses do, in fact, cause delays — and, potentially, even worse effects — when deployed at scale in Tor. We conclude by recommending that system developers seriously consider defenses that explicitly create delays — they often offer better privacy protection than padding-only defenses, which end up causing delays anyway.