Hacker News new | past | comments | ask | show | jobs | submit login

I'd figure simply quantizing timestamps with larger step sizes would work better. And sure, you can filter those out, but you can also make it take too long to be useful. You could also perform the attack on yourself and adjust accordingly, although this is not robust since it depends on deatils of each attack.



I think that might be worse. By polling your system and waiting for the clock to roll over, an attacker can almost immediately narrow down your clock to an accuracy equal to their polling interval.

Either way, though, more requests will defeat it one way or another. Whether you can make such an attack impractical will come down to how many requests the attacker can make versus how much noise you can tolerate in the timestamps.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: