Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [time]

For security issues relating to the system time of a host, or relating real-world clocks more generally. Please use the tags [timestamp] or [performance] for questions on those topics.

Filter by
Sorted by
Tagged with
60 votes
9 answers
13k views

How important is local time for security?

I recently wanted to see what happens when I change my local time to something obviously wrong. I tried the year 2218, so 200 years in the future. The result: I couldn't access any website anymore (I ...
Martin Thoma's user avatar
  • 3,932
38 votes
3 answers
13k views

Why should memcmp not be used to compare security critical data?

From man 3 memcmp: Do not use memcmp() to compare security critical data, such as cryptographic secrets, because the required CPU time depends on the number of equal bytes. Instead, ...
gaazkam's user avatar
  • 6,017
36 votes
8 answers
9k views

Why does my digital bank need my phone date and hour to be correct?

I'm not from Information Security or any IT related area. But I want to know if there is any security reason for my digital bank to demand my phone to be on "Automatic Date & Time"? For ...
RA828's user avatar
  • 473
32 votes
12 answers
15k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
beppe9000's user avatar
  • 565
16 votes
2 answers
11k views

What is the purpose of JSON Web Token (JWS)'s issued at "iat" field?

RFC 7519 specifies an optional "iat" field, indicating when a token was issued. The RFC provides a terse commentary: This claim can be used to determine the age of the JWT. What is the ...
jtpereyda's user avatar
  • 1,600
9 votes
1 answer
3k views

Can displaying date and time on screen upon TOTP login failure makes system more vulnerable?

We are using TOTP(https://datatracker.ietf.org/doc/html/rfc6238) for a web application to enhance the security. TOTP works on UTC. if system clock drifts OR NTP is not synced, TOTP generated by ...
tushars's user avatar
  • 91
7 votes
2 answers
3k views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
Bob Ortiz's user avatar
  • 6,665
7 votes
1 answer
8k views

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My ...
Roee Hendel's user avatar
6 votes
1 answer
2k views

Mitigate Time Spoofing Attack

Say Alice receives synchronized time from Tina the timekeeper. Say Ted spoofs a GPS signal, fooling Tina about the current time. Tina sends this fake time to Alice. What can Alice do to avoid being ...
jtpereyda's user avatar
  • 1,600
6 votes
1 answer
2k views

Securely detecting and correcting time drift for TOTP

RFC 6238 recommends the server to implement some form of resynchronization algorithm to account for time drift of the device used to generate the OTP. However, the RFC provides very little information ...
Emond Papegaaij's user avatar
5 votes
1 answer
6k views

Brute Forcing LUKS Full Disk Encryption - Time?

let's say we have encrypted our drive with AES 256 XTS and the following Hash: SHA1 with ~500k Iterations and a 20+ password SHA512 with ~250k Iterations and the same 20+ password. Let's think of ...
user284148's user avatar
5 votes
1 answer
903 views

What use does a TPM have for accurate timekeeping?

I stumbled across this image and something immediately stood out to me. This is a photograph of a discrete TPM card. That silver cylinder on the left is a crystal oscillator, used to tell time with ...
forest's user avatar
  • 66.8k
5 votes
2 answers
2k views

Does x509 have an "issued at" timestamp? Can you tell when an x509 certificate was issued?

The JWT Spec (RFC 7519) has an issued at field ("iat"). Does x509 have any analogous value? I see a Validity field, but nothing else time related.
jtpereyda's user avatar
  • 1,600
5 votes
1 answer
577 views

How can wrong time synchronization be exploited?

It happened to me a few times that I installed a Windows PC after the CMOS battery has been replaced and all sorts of things stopped working or threw security warnings, only to realize that I just ...
Andrei's user avatar
  • 229
5 votes
1 answer
606 views

Overall Security of Network Time Protocol

I am doing some research in order to get an understanding of the security of the Network Time Protocol. In particular, my goal was/is to understand how the protocol is secured and what the issues are. ...
Mark's user avatar
  • 159
4 votes
1 answer
948 views

Can I disable access to JS APIs in the browser such as highres timers?

In the wake of recent news of CPU bugs like Meltdown and Spectre which rely on precise(-ish) measurments of elapsed time, I find myself in the mood for disabling things like window.performance.now() ...
kralyk's user avatar
  • 161
3 votes
3 answers
278 views

Is server startup time sensitive information?

Let's say we have a web server. Server startup time is the time the server process was started. Say, the startup time was being leaked via its response headers due to the carelessness of a ...
candh's user avatar
  • 133
3 votes
3 answers
1k views

Feasibility of time-based database brute-force attacks on websites

I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
23785623985's user avatar
3 votes
1 answer
629 views

Can AWS Time Sync be argued PCI compliant?

We're setting up a card processing service on Amazon AWS, and were wondering whether the AWS Time Sync service could be incorporated without running afoul of the PCI time sync requirements? ...
zanerock's user avatar
  • 131
2 votes
3 answers
2k views

Is it safe to assume that my computer's clock will always be synced with actual time within the second or a few seconds at the worst?

Years ago, I was running a service where the moderators were able to do various actions with massive privacy implications if the accounts or contributions were less than a short period of time. I did ...
Ned's user avatar
  • 21
2 votes
1 answer
251 views

Secure way to update Date & Time of a Linux Embedded Device

I have a Linux (4.9.171) machine running on ARM Cortex-A processor. The system has internet connection and talks to my server over SSL. At the first boot, I can configure the date and time to it. ...
abhiarora's user avatar
  • 123
2 votes
1 answer
134 views

Authorization expiration without reliable clock / time

I've been looking, but I think its impossible to find a pairing solution that has the benefits of authorization expiration and renewal (like x509 cert expiry and OAuth expires_in), but that works ...
Raveclatter's user avatar
2 votes
1 answer
437 views

Are servers that do not implement time services vulnerable to clock skew attacks?

An article describes clock skew attack possibilities §§: These can be attacked by repeatedly connecting to the hidden service, causing its CPU load, hence temperature, to increase and so ...
Pacerier's user avatar
  • 3,313
1 vote
1 answer
2k views

Difference between system uptime and last boot time in windows

As it shows in attached pictures, there is a "Difference between system uptime and last boot time" in my windows, it becomes an issue because AV, SIEM or every monitoring system shows a different time ...
R1W's user avatar
  • 1,627
1 vote
1 answer
1k views

techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind) [closed]

I would like to know about these 2 SQL Injection techniques. I completed my studies in SQL databases and my teacher told me about SQL injection, then I became interested in this topic. I discovered a ...
d. fritoti's user avatar
1 vote
1 answer
1k views

Can setting the date on your iPhone to the epoch really brick it? [closed]

So, I've started seeing warnings that there is a troll/hoax saying that people should set the date on their phone to 1st January 1970 to get a retro logo to display. The warnings say that this will ...
HorusKol's user avatar
  • 139
1 vote
1 answer
179 views

Is "time locking" a good strategy for protecting data with HSMs?

I've read several times that many HSMs support configurable rate limiting on cryptographic operations, as a way of protecting against a hacker that compromises a server that has access to the HSM. So ...
bnsmith's user avatar
  • 87
1 vote
1 answer
244 views

Is it possible to verify that a signature was made prior to the content of the document it is found on?

In What to do after I signed a blank sheet of paper given to me by my manager?, a distressed individual (B) has signed a blank piece of paper and given it to an adversary (A). A has openly stated to ...
Fiksdal's user avatar
  • 3,107
1 vote
1 answer
223 views

How is resynchronization performed for security keys / MFA devices?

When a MFA (time based) device security key drifts out of synchronization there is a procedure to resynchronize it. But there is no input to the device itself. Smartphone apps don't have this ...
Skaperen's user avatar
  • 315
1 vote
5 answers
489 views

Does disclosing server local time to users cause any security risks?

I need to implement a number of web pages for resetting an API access key: user must be logged in first user gets to "confirmation" page that has a "confirmation" link with a time token inserted user ...
sharptooth's user avatar
  • 2,241
1 vote
0 answers
951 views

Prevent browsers from providing time zone info to webservers

I use Cloudflare's Warp VPN all the time for regular browsing and yet I recently found that Patreon can tell the country I'm physically located in. It baffled me how it could do so; Patreon could tell ...
Oxwivi's user avatar
  • 111
1 vote
0 answers
158 views

How to get a completely isolated virtual time using Xen? [closed]

Referring to the following quote https://www.kernel.org/doc/Documentation/virtual/kvm/timekeeping.txt 4.8) Covert channels and leaks In addition to the above problems, time information will ...
adrelanos's user avatar
  • 764
0 votes
2 answers
11k views

AES algorithm encryption time

What is the time taken by an AES Encryption algorithm, with a key of 128 bits, operating on a normal computer (say with Intel i7) and what will be the impact be on the time if I wish to use a 256 bit ...
Lokanath's user avatar
  • 173
0 votes
1 answer
117 views

Adobe PSIRT Average Response Time [closed]

Anyone have any experience in contacting the Adobe Product Security Incident Response Team (PSIRT)? I sent in an exploit that I found two weeks ago and I have not heard from them since. Would they ...
guest28300039's user avatar
0 votes
0 answers
85 views

Making time(0) produce an error

I'm currently reviewing/reversing a software (coded in C) and it has a line like this : time_t var = time(0); My goal it to get this time(0) call to return -1. (I cannot modify the parameter.) ...
531-M31C's user avatar
0 votes
0 answers
245 views

Could someone bypass a GPG key's expiration date by simply using that key on a computer with an incorrect system time?

I've heard it's good for security to have a shorter expiration time for GPG keys, but I'm still not clear on why that is exactly. Is the purpose of a GPG key mainly to inform the legitimate user that ...
Seán Healy's user avatar
0 votes
0 answers
137 views

In the time side channel, is there any way to improve the measurement time accuracy?

I want to measure the execution time of a function. The execution time of this function is only slightly different in the two cases. Is there any way I can accurately measure its time to distinguish ...
Gerrie's user avatar
  • 101
0 votes
0 answers
328 views

How can a SOCKS5 proxy know client's datetime?

It seems that SOCKS5 proxies somehow know the client's timezone (at least) or maybe even the precise datetime. I determined this because the proxy tears the connection in case the local timezone on ...
Serge Rogatch's user avatar