IETF discusses improving NTP security

[Patrick]

Some questions were answered here:

Suggest Trustworthy Tor Hidden Services as Time Sources for sdwdate

Public invitation for comments. https://forums.whonix.org/t/suggest-trustworthy-tor-hidden-services-as-time-sources-for-sdwdate/856 I will move comments on pool members (sdwdate source onions) to that thread. Not much. Entries break without anyone noticing or reporting or otherwise looking at these Open Source available lists. Except recent discussion in that thread, no. No. No.

@micky

Some of the smaller sites probably don’t qualify as “having great amount of traffic” then. For example, anonguide.cyberguerrilla.org or ev0ke.net.

Quite possible.

@micky

where do they get their time from? probably ntp?

Speculate ntp indeed.

It’s a problem indeed. sdwdate-server project is non-existing. It’s like starting another project.

@micky

do the smaller securedrop-centered site care much about accurate time?

Might not.

@micky

Any stats collected regarding that?

No.

@micky

Any attempts done to check those points?

No.

@micky

Not that I have a better way, but the whole concept looks pretty subjective. Which pools are “likely to keep their users privacy” becomes highly speculative when we need a large number of servers.

Indeed huge risk of law of triviality / bikeshed.

@micky

Is it better to have 10 well-trusted and high-volume servers instead of 20+ maybe’s?

For some aspects possibly yes. Downsides:

• then these 10 servers become more worthwhile targets.
• too few servers might result in too much traffic for these servers and then them blocking sdwdate (by removing time from http header).

---

The issues are rather obvious. You noticed quite a few of them. sdwdate requires development contributions.