Hacker News Reader

NTP doesn't cryptographically verify the time. All you do is have your router redirect these NTP requests to your own server, which is set to serve the wrong time.

Ironically, part of an HTTPS handshake involves sharing the server time in a cryptographically-verifiable manner. I am not sure why they don't use that! https://github.com/ioerror/tlsdate

View on HN

That only works for current TLS. Version 1.3 makes sending the server date optional.

Optional, but does anyone turn it off? They control their own servers, anyway.

Optional for the implementations. So basically your ssl library is unlikely to do it. And at that point having a "getTime()" API call in your service is simpler than having a custom patched SSL implementation.

Oh, common SSL libraries don't do it? Even then you can probably rely on a Date header being attached to all your existing requests.

Well, I didn't say it was a good way ;)

Reply on news.ycombinator.com