How Dodge defends

Watched normally, a video downloads to your browser as a distinctive sequence of segment sizes. Every video has its own sequence, so an observer on the network can compare the sizes they see against a catalog of known videos to identify what you're watching.

What Dodge changes

Dodge doesn't change any video content. You still see the video you picked, at whatever quality your connection supports. What Dodge changes is the size and timing of the segments your browser downloads, so that with a well-designed defense, the sequence of segment sizes on the network no longer matches any one video. It does this in a few ways:

• Downloading segments in parts, as several smaller requests, rather than all at once.
• Fetching extra data that is discarded as soon as it arrives, purely to change the pattern on the network.
• In some cases: occasionally fetching a segment at a different quality level than the one you're watching.

Exactly what happens depends on which defense you choose; Dodge itself just provides the building blocks and machinery for defenses.

In most cases, defenses don't change what plays on your screen at all; unless you're using a particularly strong defense, your experience of the video should be nearly unaffected. The goal of Dodge is to only affect what an observer of your network traffic sees.

before / aftershape ≠ identity

Defenses are ready-made files

Each defense is a small file called an extended manifest, published alongside a video. It specifies exactly which segments your browser should fetch, in what order, and at which sizes, rewriting the undefended pattern. A content provider can provide defenses with their videos so that they're defended from the start. Otherwise, the browser extension, still in development, will let you apply a defense yourself to videos that weren't set up with it.

Defenses differ in how much they hide and how much extra data they download; in general, a stronger defense costs more bandwidth and may have more perceptible effects on playback. The documentation covers threat model & security, explaining how much protection you can expect from different defenses, and how to choose a defense in detail.

If a video can't be defended, playback stops

Dodge is built to fail closed: if something goes wrong while applying a defense (such as if an extended manifest contains errors), playback stalls instead of falling back to the unprotected pattern. You may need to retry with another defense, but you won't be exposed.

What Dodge doesn't cover

Dodge defends against video fingerprinting specifically: the pattern of segment sizes described above. It doesn't hide the fact that you're streaming or the fact that you're using defenses, and it isn't a general anonymity tool. It won't disguise other kinds of network activity, and it won't hide your identity or location the way a VPN or Tor is meant to.

Dodge also can't hide what you're watching from the video server itself. It changes the pattern that an observer on the network between you and the server sees, but the server still receives your requests directly, so it can see which videos you watch and, if you're signed in, tie that to your account. Watching over a VPN or Tor and logged out is what addresses that; the docs describe what Dodge does and doesn't assume about the server in more detail.

In short, Dodge is designed to work against one specific attack, and what you can expect depends on which defense you choose. Dodge is not a guarantee that you can't be watched some other way. For a closer look at the attack, see how video fingerprinting works.