LEARN

How video fingerprinting works

How an observer turns a sequence of segment sizes into the title you are watching.

Modern video streaming most often uses DASH (Dynamic Adaptive Streaming over HTTP) or some variant of it. Videos are encoded (stored) at several quality levels (1080p, 720p, 480p, and so on), which are called representations. Each representation is split into many short segments, each a few seconds long, and your browser fetches them one at a time as you watch, sometimes switching quality mid-playback when your network speed changes.

one video · three quality levels segments of equal duration
1080p 720p 480p → the dark path is what the player downloads, switching rows as network speed changes t →

Two facts about video segments make fingerprinting possible:

  • Every segment in a representation has the same duration (except possibly the last one).
  • Their sizes vary and are correlated with content complexity.

The periodic segment downloads that your browser initiates result in distinct bursts of network traffic, and each burst reveals the approximate visual complexity of the underlying segment. Generally, segments that encode action scenes are large, while those that encode still frames, with minimal detail/motion, are small. By observing enough segment downloads, it's possible to discern the complexity profile of an entire video or a large portion of it, making it fairly easy to identify the video. This attack is called video fingerprinting, and it falls within the broader research area of traffic analysis.

segment size over timeunits: KB
900 600 300 0 t → action still action

Why encryption doesn't fix this

HTTPS encrypts the actual video data, but it doesn't hide the sizes of encrypted segments, which are about the same as the unencrypted sizes. An observer can still see "the browser fetched a 412 KB segment, then a 380 KB segment, then a 95 KB segment...". This pattern of sizes is the fingerprint, and the video data itself doesn't need to be readable.

VPNs and Tor don't change the signal: an encrypted, anonymized tunnel still carries the segment sequence at a granularity that attackers can use.

what an observer sees https · contents unreadable
browser video server encrypted connection 412 KB 380 KB 95 KB → bytes are unreadable, but the size and timing of every download stay visible

What it takes to identify a video

An attacker needs three things:

  1. Access to the network between you and the video server to see your segment requests.
  2. A known catalog of fingerprints, which they can build by watching the same content themselves.
  3. A classifier that maps "observed segment size sequence" to "best matching catalog entry".

This is well established in the academic literature, including the paper behind Dodge.

three titles · same network observer distinct identities
video_A video_B video_C → encryption hides bytes; size and timing remain visible

What Dodge changes

A Dodge defense rewrites which segments your browser fetches, and at which sizes. The video you see on screen is the same, but the network traffic is different. With a well-designed defense, the size pattern doesn't match any specific catalog entry. For a more in-depth explanation of what Dodge does, see how Dodge defends.