[quonn]

His argument is mostly based on analysing the size of the data transferred. Let's assume HTTP/2 for the moment. You have a single encrypted channel to a particular website that contains multiple interleaved opaque streams. It's not easily possible to extract the exact size of a single request from this. Furthermore, for a typical news website, for example, there will be an huge number of pages, they are dynamic and constantly changing and they will all have a very similar size.

You do get privacy. If anyone claims otherwise, he should go and prove that it's possible and easy by providing a firesheep-like tool. It would make for a nice research paper.

[jrnvs]

Here's an article describing how to find out what someone is watching on Google Maps by analyzing the encrypted traffic. http://blog.ioactive.com/2012/02/ssl-traffic-analysis-on-goo...