3 ms·
The article doesn’t talk about a fix—scary. I know OpenBSD uses a similar SSL-based method for time keeping on startup, but I’ve never experienced an issue like
by binkHN 3y ago
The article doesn’t talk about a fix—scary. I know OpenBSD uses a similar SSL-based method for time keeping on startup, but I’ve never experienced an issue like this.
- tedunangst 3y agoOpenbsd does an https (with expiry checks disabled) GET to google.com (or another server) and uses the Date header in the response.
- JohnFen 3y agoIf it's assuming that it can make an internet connection, why does it do that rather than NTP?
- toast0 3y agoNTP is trivially MITM. Secure NTP is basically not deployed anywhere. Someone with a google.com cert that's valid other than expiration is probably google and probably has a working clock.
- anthk 3y agoYou can always use a gpsd(4) compatible USB dongle as the time source.
- JohnFen 3y agoOr run their own NTP server. That's what I do in my home network.
- toast0 3y agoSure, if you have such a dongle, and it has sufficient view of the sky. Adding a 'free' https based sanity check on top of NTP seems like a good balance of cost vs reward. gps (and friends) is a nice way to get access to a very accurate timesource, but it's not always worth the cost.
- labawi 3y agoGPS doesn't send full time. It wraps every 1024 weeks, or about 20 years, hence you need a (very) rough basis in case the system is over 20 years old.
- somat 3y agoIt is a sanity check to protect against malicious ntp actors. http://man.openbsd.org/ntpd.conf#CONSTRAINTS http://man.openbsd.org/ntpd.conf#CONSTRAINTS
- simendsjo 3y agoIt's easy to turn off the feature, and its described in their original blog post. The article doesn't mention it directly though.
- newman314 3y agoThe fix is to disable. Here's the PowerShell cmd to do so: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config" -Name "UtilizeSslTimeData" -Type DWord -Value 0