3 ms·

https://www.ntpsec.org/ https://www.ntpsec.org/

• brandmeyer 11y ago
  Improving the security of the Internet's go-to time transfer protocol is certainly useful. However, switching to a different protocol would not mitigate this port scanning attack. According to this researcher, just sending an empty packet to an NTP server's port is sufficient to result in a port scan back.
  • imglorp 11y ago
    ... Which is the sort of bugs ntpsec effort is fixing.
• toast0 11y ago
  That doesn't really help, if you make an NTP request to a remote server, the server and all elements of the network path will know the source IP you used. You can't avoid that without also avoiding getting the response from the request. Using a broadcast time source (CDMA/GSM, GPS/Galileo/GLONASS, WWV/WWVH/international equivilents?, ATSC broadcasts, etc), or choosing a trusted time server would be alternatives; you could also use a telephone time service and leak your phone number instead of your ip address.
• tptacek 11y ago
  I am not optimistic about this project, which seems to involve people who don't have much of a track record in secure programming trying to refactor a giant blob of C code.