Date: Mon, 22 Dec 2014 07:39:25 +0100 From: Hanno Böck <hanno@...eck.de> To: Kurt Seifried <kseifried@...hat.com> Cc: oss-security@...ts.openwall.com Subject: Re: can we talk about secure time? On Sun, 21 Dec 2014 23:30:10 -0700 Kurt Seifried <kseifried@...hat.com> wrote: > Having to reconcile multiple logs/events across widely distributed > systems, especially in high volume situations, 1-2 seconds is a deal > breaker. Or people running SCADA systems for industrial plants. Or > people that run financial systems. I don't think this contradicts my statement that average consumer hw doesn't need the high accuracy of ntp :-) > So it's not an either/or situation (care about security, or have > accurate time, sometimes we need both). Yeah, I totally agree that this would be the desired thing to have. However the facts are that at the moment we don't. And imho for consumer HW the slight inaccuracy of tlsdate doesn't matter, while the insecurity of ntp does (as the very practical hsts attack has shown). I read these days that the Linux foundation is sponsoring some work on NTP. Anyone involved in this and can comment whether secure authentication for NTP is something that's being looked at or if it is only about creating a better implementation of the ntp software? -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.