4 ms·
The whole point of the exercise was to make it secure though. If you don't care about MITM attackers then NTP works great.
by jandrese 3y ago
The whole point of the exercise was to make it secure though. If you don't care about MITM attackers then NTP works great.
- numpad0 3y agoI don't get the supposed security aspect of getting false time. Hacker gives you 1980-01-01 or 4096-13-32 and mess up CRL and ruin your day...how. Years ago I've tried privilege escalation exploit to play with a phone and it involved rolling back date to unexpire signature, so I know there is exploit potential, but it... it just feels like RTC bootstrap problem should be something solvable.
- creeble 3y agoIsn't that a provably pointless exercise though? Security protocols (at least the ones in common use) require certificates or keys that eventually expire, because of the risk of a permanent key being compromised. If they expire, the protocol needs time. QED.