diff options
| author | Daniel Micay <danielmicay@gmail.com> | 2023-03-19 02:02:47 -0400 |
|---|---|---|
| committer | Daniel Micay <danielmicay@gmail.com> | 2023-03-19 02:05:59 -0400 |
| commit | b4077713f5129f6924c65d8caf7f23bcb02c79eb (patch) | |
| tree | 83fc80cc702be2019d87316200f4f24cf235223f /static/faq.html | |
| parent | 50e3649bf8fcb00a9044927ba36089ce25ef1de2 (diff) | |
improve network time documentation
Diffstat (limited to 'static/faq.html')
| -rw-r--r-- | static/faq.html | 25 |
1 files changed, 14 insertions, 11 deletions
diff --git a/static/faq.html b/static/faq.html index 38de71fb..a3e6a0c4 100644 --- a/static/faq.html +++ b/static/faq.html @@ -806,17 +806,20 @@ repository.</p> </li> <li> - <p>An HTTPS connection is made to https://time.grapheneos.org/generate_204 to - update the time from the custom X-Time header field, which has millisecond - precision, or falls back to the Date header if X-Time is not available with less - precision. GrapheneOS also lowers the system clock drift warning from 2000 milliseconds - to 250 milliseconds, and the time update threshold from 2000 milliseconds to 50 - milliseconds. This is a full and more precise replacement of Android's standard - network time update implementation, which uses the cellular network when available - with a fallback to SNTP when it's not available. Network time updates are security - sensitive since certificate validation depends on having an accurate time, but - the standard NTP / SNTP protocols used across most OSes have no authentication - or encryption.</p> + <p>An HTTPS connection is made to + https://time.grapheneos.org/generate_204 to update the time with a + millisecond precision X-Time header. As part of future support for + using other services, it falls back to the standard Date header with + second precision.</p> + + <p>This is a full replacement for Android's standard network time + update implementation, which uses unauthentication SNTP (Simple + Network Time Protocol) with fallback to the cellular network when it's + not available (GNSS can also be used as a time source but is disabled + by default, and OEMs can choose the priority order). Network time + updates are security sensitive since certificate validation depends on + having an accurate time, but the standard NTP / SNTP protocols used + across most OSes have no authentication or encryption.</p> <p>We plan to offer a toggle to use the standard functionality instead of HTTPS-based time updates in order to blend in with other devices.</p> |