Dodge makes it much harder to tell what you're watching, without disrupting playback. It reshapes the segment-by-segment download pattern of streaming video so that prying eyes (a coffee shop neighbor, a network admin, an ISP) no longer see an identifying fingerprint. Add it to your own site as a video player module, or use it yourself with the browser extension once it's released.
When you watch online video, your browser doesn't download the file all at once. It fetches a sequence of segments, small pieces a few seconds long.
Every segment has the same duration, but not the same size. For example, action scenes are large, and still scenes are small.
Different videos produce different sequences of sizes, and these differences are significant enough to identify a specific title from a known catalog.
Anyone watching your network, whether they run the cafe's router, your campus, or your ISP, can use videos' patterns to identify what you're watching.
A Dodge defense reshapes the download sequence so the visible traffic no longer identifies a specific title. There are many ways to do this, each with its own goals and trade-offs in viewing experience.
Want to watch videos that haven't been published alongside a defense, or verify that your content provider has set up Dodge correctly? The browser extension, still in development, will swap out undefended players so you can start defending.
To learn more about the attack and what defenses do about it, read
how video fingerprinting works and how Dodge defends.
The browser extension swaps out undefended players for Dodge, applies ready-made defenses, and verifies defense setups.
The extension →Use the dash.js module in your player, generate defenses with our tools, or write your own that follow the extended manifest spec.
Docs →Traffic analysis defense, especially for video, is a young research area. A poorly designed defense can leak as much as no defense at all, and we'll continue learning about what works as more people deploy. Dodge is engineered to be safe by default: with a well-thought-out defense, your traffic should be no easier to identify than without one; usually much harder.
We publish our research, source code, and limitations openly. If you're a content provider thinking about deployment, we'd like to help.