security/hakurei.app
security/hakurei.app
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

improve network time documentation

Browse Source
This commit is contained in:
Daniel Micay 2023-03-19 02:02:47 -04:00
parent 50e3649bf8
commit b4077713f5
2 changed files with 18 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
static/faq.html
View File

@ -806,17 +806,20 @@
repository.</p>
</li>
<li>
<p>An HTTPS connection is made to https://time.grapheneos.org/generate_204 to
update the time from the custom X-Time header field, which has millisecond
precision, or falls back to the Date header if X-Time is not available with less
precision. GrapheneOS also lowers the system clock drift warning from 2000 milliseconds
to 250 milliseconds, and the time update threshold from 2000 milliseconds to 50
milliseconds. This is a full and more precise replacement of Android's standard
network time update implementation, which uses the cellular network when available
with a fallback to SNTP when it's not available. Network time updates are security
sensitive since certificate validation depends on having an accurate time, but
the standard NTP / SNTP protocols used across most OSes have no authentication
or encryption.</p>
<p>An HTTPS connection is made to
https://time.grapheneos.org/generate_204 to update the time with a
millisecond precision X-Time header. As part of future support for
using other services, it falls back to the standard Date header with
second precision.</p>
<p>This is a full replacement for Android's standard network time
update implementation, which uses unauthentication SNTP (Simple
Network Time Protocol) with fallback to the cellular network when it's
not available (GNSS can also be used as a time source but is disabled
by default, and OEMs can choose the priority order). Network time
updates are security sensitive since certificate validation depends on
having an accurate time, but the standard NTP / SNTP protocols used
across most OSes have no authentication or encryption.</p>
<p>We plan to offer a toggle to use the standard functionality instead of
HTTPS-based time updates in order to blend in with other devices.</p>

4
static/features.html
View File

@ -953,6 +953,10 @@
<li>Screenshot shutter sound is toggleable using the "Touch sounds" option in Settings ➔
Sound &amp; vibration while still following the standard method of putting the device
on vibration/silent mode to turn off the screenshot shutter sound.</li>
<li>More precise system clock via lowering the system clock time update
threshold from 2000ms to 50ms and lowering the system clock drift warning
from 2000ms to 250ms. This can be helpful for time-based protocols such as
TOTP.</li>
</ul>
</section>
</section>