Hacker News Reader

Comment by binkHN | Hacker News Reader

The article doesn’t talk about a fix—scary. I know OpenBSD uses a similar SSL-based method for time keeping on startup, but I’ve never experienced an issue like this.

View on HN

Openbsd does an https (with expiry checks disabled) GET to google.com (or another server) and uses the Date header in the response.

If it's assuming that it can make an internet connection, why does it do that rather than NTP?

NTP is trivially MITM. Secure NTP is basically not deployed anywhere. Someone with a google.com cert that's valid other than expiration is probably google and probably has a working clock.

You can always use a gpsd(4) compatible USB dongle as the time source.

Or run their own NTP server. That's what I do in my home network.

Sure, if you have such a dongle, and it has sufficient view of the sky. Adding a 'free' https based sanity check on top of NTP seems like a good balance of cost vs reward.

gps (and friends) is a nice way to get access to a very accurate timesource, but it's not always worth the cost.

GPS doesn't send full time. It wraps every 1024 weeks, or about 20 years, hence you need a (very) rough basis in case the system is over 20 years old.

It is a sanity check to protect against malicious ntp actors.

http://man.openbsd.org/ntpd.conf#CONSTRAINTS

The fix is to disable.

Here's the PowerShell cmd to do so: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config" -Name "UtilizeSslTimeData" -Type DWord -Value 0

It's easy to turn off the feature, and its described in their original blog post. The article doesn't mention it directly though.

Reply on news.ycombinator.com