You Can't Trust Network Time

Re:You Can't Trust Network Time by TheRealPomax on Sunday April 28, 2019 @03:43PM (#19773233)

There is only a catch-22 if we need _that time source_ to verify its time.

That's not how things work, though: we have hundreds available, so there is no catch-22 whatsoever: we check multiple sources and go with the majority vote, then flag an error for any outlier(s).

[ Parent | on HN ]

Re:You Can't Trust Network Time by michaelt on Sunday April 28, 2019 @06:07PM (#19774020)

If your wifi connection is MITMed, your adversary could MITM all the connections, even if you make hundreds.

If you have trouble imagining a user taking their wifi lightbulb to a coffee shop, imagine instead you're a device vendor and a customer is trying to MITM their own device to embarrass you in a Defcon presentation...

[ Parent | on HN ]

Re:You Can't Trust Network Time by TheRealPomax on Monday April 29, 2019 @01:20PM (#19780400)

Sure, but now you've turned it from "You can't trust network time" into "you can't trust your wifi" and while 100% correct: now you're commenting on a different article altogether.

[ Parent | on HN ]

Re:You Can't Trust Network Time by Xylakant on Sunday April 28, 2019 @06:17PM (#19774078)

How do you know that it’s not the majority of your sources that has been mitm’ed?

[ Parent | on HN ]

Re:You Can't Trust Network Time by datenwolf on Sunday April 28, 2019 @06:29PM (#19774137)

Not all of these sources come through the Internet. Think GPS, GSM, radio time signals (DCF-77 or the likes).

[ Parent | on HN ]

Re:You Can't Trust Network Time by misterkgb on Sunday April 28, 2019 @10:08PM (#19775295)

Those solutions all require additional hardware - hardware that's far more expensive than an on-board real-time clock and battery.

[ Parent | on HN ]