The use of "time" - a weakness worth noting?

[ericelliott]

The use of "time" - a weakness worth noting?

[brianmhunt]

I feel like this is a valid concern because there have recently been publications of several exploits in modern NTP servers, and, I understand more than one reputable NTP providers was actually compromised.

I think the 2015 workaround is reasonable, though better still might be if the minimum date timer were that of the credential build.

[tjconcept]

I think the 2015 workaround is reasonable, though better still might be if the minimum date timer were that of the credential build.

Would make sense, but might be overkill (more code and more moving parts might introduce an even bigger risk).

[tjconcept]

I feel like this is a valid concern because there have recently been publications of several exploits in modern NTP servers, and, I understand more than one reputable NTP providers was actually compromised.

Doesn't the OS do anything to mitigate this kind of attack? Like consulting multiple services?

[brianmhunt]

Doesn't the OS do anything to mitigate this kind of attack? Like consulting multiple services?

It is probably unwise to presume such mitigation exists and defeat all compromises. 😞

[tjconcept]

It is probably unwise to presume such mitigation exists and defeat all compromises.

I'm not trying to shift responsibility. Just asking out of curiosity.

[ericelliott]

Hard-code a minimum. No added API for security risk.

[mastilver]

Would it be secure enough to check at init, or every time we want to use?

So I think we should replace Date.now() by a function that throw an error if the time before 2015

And be aware: do not use (new Date).getFullYear() to check the year and then Date.now() to get the date
Just in case a third party module override only the now function but don't change anything else

[tjconcept]

Not sure whether it should throw or just use it as a minimum.
Anyway I would just store the Date.now() call in a variable, check the variable to be greater than a hard-coded value, and then either throw or use Math.max(Date.now(), hardcoded).

[mastilver]

👍 yeah I agree, it might not be a good idea to throw :)

[brianmhunt]

I think hard-coding is better, as @ericelliott says.

The hard-coded minimum can be the build-date for the library.

[tjconcept]

Hard-coding: 👍
Build-time: 👎 (too many moving parts)
Throw: 👎 (I think console.warn would be sufficient if it falls back to the hard-coded value - I'm afraid the other would cause too much of a surprise)

[mastilver]

👍 Sounds good to me
We will just need to bump it every year, It's not a big deal ;)

[ericelliott]

Math.max(Date.now(), hardcoded)

👍