logoalt Hacker News

mort96yesterday at 9:28 AM2 repliesview on HN

>> TCP_NODELAY can also make fingerprinting easier in various ways which is a reason to make it something you have to ask for

> Only because it's on by default for no real reason. I'm saying the default should be off.

This is wrong.

I'm assuming here that you mean that Nagle's algorithm is on by default, i.e TCP_NODELAY is off by default. It seems you think the only extra fingerprinting info TCP_NODELAY gives you is the single bit "TCP_NODELAY is on vs off". But it's more than that.

In a world where every application's traffic goes through Nagle's algorithm, lots of applications will just be seen to transmit a packet every 300ms or whatever as their transmissions are buffered up by the kernel to be sent in large packets. In a world where Nagle's algorithm is off by default, those applications could have very different packet sizes and timings.

With something like Telnet or SSH, you might even be able to detect who exactly is typing at the keyboard by analyzing their key press rhythm!

To be clear, this is not an argument in favor of Nagle's algorithm being on by default. I'm relatively neutral on that matter.


Replies

silisiliyesterday at 4:06 PM

> I'm assuming here that you mean that Nagle's algorithm is on by default, i.e TCP_NODELAY is off by default.

Correct, I wrote that backwards, good callout.

RE: fingerprinting, I'd concede the point in a sufficiently lazy implementation. I'd fully expect the application layer to handle this, especially in cases where this matters.

BenjiWiebeyesterday at 3:52 PM

As of recently, OpenSSH prevents keystroke timing analysis on it's own.