This is a follow up to the original question Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
D.W. provided an extensive summary on attack vectors on HTTPS/TLS connections.
What are the attack vectors against http/2? Are the attack vectors against HTTP/2 still the same as HTTP or are some of them mitigated by HTTP/2 features? (and: are there new ones).
HTTP/2 allows serving multiple requests over a single connection, so potentially (?) an eavesdropper would no longer be able to extract size and timing information as in https. Furthermore since a single connection is used, the number and size of resources (other than the total) should be obscured too?
Existing vectors from HTTPS:
TLS reveals to an eavesdropper the following information:
- the site that you are contacting
- the (possibly approximate) length of the rest of the URL
- the (possibly approximate) length of the HTML of the page you visited (assuming it is not cached)
- the (possibly approximate) number of other resources (e.g., images, iframes, CSS stylesheets, etc.) on the page that you visited (assuming they are not cached)
- the time at which each packet is sent and each connection is initiated. (@nealmcb points out that the eavesdropper learns a lot about timing: the exact time each connection was initiated, the duration of the connection, the time each packet was sent and the time the response was sent, the time for the server to respond to each packet, etc.)
All those reveals seem (?) to rely on the 1:1 relation between HTTP request and TLS connection. So with that 1:1 relation gone it should/might be harder to extract these information (but eventually not impossible)?