Hacker News Reader

Would anyone here have any idea why "net.ipv4.tcp_timestamps=0" is recommended as a security enhancement?

From what I've read online, it should be possible to estimate the uptime of your machine with TCP timestamps.

I'm not sure why this would be a problem, maybe an attacker can see that you haven't rebooted to install a kernel update?

Ah, interesting. I think I recall reading that attacks against crypto can be helped by uptime estimates.

Uptime can be used as a source of "randomness" in PRNGs, so knowing that bit of information could clearly be beneficial to an attacker.