You get PADDING, everybody gets PADDING! You get privacy? Evaluating practical QUIC website fingerprinting protections for the masses

TL;DR

This paper evaluates the effectiveness of QUIC padding defenses against website fingerprinting in real-world browsing scenarios, revealing their limited protection against powerful adversaries and highlighting deployment challenges.

Contribution

It provides a comprehensive analysis of QUIC-padding defenses against WF during actual browsing, extending prior VPN-focused studies to real-world conditions and identifying deployment challenges.

Findings

Network-layer padding offers limited protection against strong adversaries.

Application-layer defenses require deployment by multiple parties to be effective.

Padding is ineffective against adversaries with partial traffic visibility.

Abstract

Website fingerprinting (WF) is a well-know threat to users' web privacy. New internet standards, such as QUIC, include padding to support defenses against WF. Previous work only analyzes the effectiveness of defenses when users are behind a VPN. Yet, this is not how most users browse the Internet. In this paper, we provide a comprehensive evaluation of QUIC-padding-based defenses against WF when users directly browse the web. We confirm previous claims that network-layer padding cannot provide good protection against powerful adversaries capable of observing all traffic traces. We further demonstrate that such padding is ineffective even against adversaries with constraints on traffic visibility and processing power. At the application layer, we show that defenses need to be deployed by both first and third parties, and that they can only thwart traffic analysis in limited situations. We identify challenges to deploy effective WF defenses and provide recommendations to address them.