Indeed, a simple search for "passive ssl fingerprinting" would have given them a few leads, including my blog posts from 2009. It's not something anyone can claim to be novel in 2016.
To their credit, they focus on traffic patterns, without looking at any data. That's actually interesting, but a bit weird, because TLS leaks a lot of information about clients in the ClientHello message. Incorporating the additional information would have helped them increase the accuracy.
To their credit, they focus on traffic patterns, without looking at any data. That's actually interesting, but a bit weird, because TLS leaks a lot of information about clients in the ClientHello message. Incorporating the additional information would have helped them increase the accuracy.