In this paper (PDF) delivered at the CODASPY’17 conference in March, Kranch explains that the TCP/IP headers of a Netflix HTTPS stream provide a 99.5 per cent content fingerprint.

Yes, HTTPS is meant to provide privacy, and no, Netflix isn't doing anything dumb like putting movie titles in headers: the variable bitrate (VBR) encoding happens to yield up predictable behaviour, particularly in how the byte-range portion of HTTP GET commands perfectly aligns with individual video segment boundaries.

[…]

Kranch offers a couple of ideas to fix the issue. For example, he says, “the browser could average the size of several consecutive segments and send HTTP GETs for this average size. As an alternative approach, the browser could randomly combine consecutive segments and send HTTP GETs for the combined video data.”

Joli mais sans surprise (le chiffrement ne résout pas tous les problèmes, quelle surprise). :)

Via #ttnn