Clock Inaccuracy Data

Posted on by

It would be rather useful to have information on how inaccurate people’s clocks are. Some security protocols, such as OCSP certificate revocation checking, can (in some circumstances or configurations) be affected by how accurate the user’s clock is.

This means that if 90% of the Internet is going around with clocks which are several hours out, the protocol in that configuration would be more insecure than if everyone’s clock was accurate to the nearest second. So it would be nice to have a chart of number of users against inaccuracy.

One could measure this info reasonably easy on a web page – just call
new Date().toGMTString() and send it back to a server which is connected to an accurate clock. Does anyone know of a source of such data? Ideally, it would be from a website whose visitors were a cross-section of the Internet population.

8 thoughts on “Clock Inaccuracy Data”

  1. While I don’t have any actual numbers, it should be noted that Windows XP enables NTP synchronization by default, so I’m sure it’s not far fetched to say that most XP users have a pretty accurate clock, which in itself accounts for a huge chunk of Internet users. I don’t know about most Linux distros and Mac OS X, though.

  2. Markus Lindstr�m said:
    > I don’t know about most Linux distros and Mac OS X, though.

    OS X defaults to syncing to time.apple.com via NTP, but after a little bit of googling on “time.apple.com” I believe this option may be disabled by default.

  3. I found Windows XP NTP synchronization inaccurate and turned it off – must be their default serve.r

    In particular, on my Windows Media PC, I missed the first couple minutes of every show.

    Mike Kaply

  4. Actually windows XP only tries to be within 10 minutes (in a domain setup) so I am not sure how good it is stand alone. But from my experience not too good. I ended up depolying ntpd internally because we have some machines for running some experimental test benches that need to record events with an accurate time stamp (within a second).

  5. I believe the Windows XP time synchronisation thingy only synchronises once a week. I’m not sure how long it waits for before trying again if it can’t synchronise. As Fred F. said, if you’re on a domain, all bets are off.

    Anyway, I use Windows XP and have it set to synchronise from time.windows.com as is the default. It last synchronised on Friday 3rd June at 8:56pm BST (UTC +0100). The computer has been on since then and neither I nor anything else has adjusted the time (to my knowledge). I’ve just compared it with http://www.time.gov/timezone.cgi?UTC/s/0/java and it appears to be about 19 seconds fast.

    Mike Kaply said that he thnks the default server might be inaccurate. According to http://www.pcworld.com/news/article/0,aid,76744,00.asp, in late 2001 it was noted to be up to nine minutes out.

    Every now and again, I get an email from my mum (she uses Windows 98) with the time extremely out of whack (months in some cases). Then I know it’s time for the how-to-set-the-time-and-date phone call.

    I’ve never really understood why emails don’t use the initial SMTP server’s time, as it’s probably more accurate than your average Internet user’s computer clock. I’ve also never understood why no motherboard manufacturer has thought to stick a quartz crystal on their motherboard to make the time-keeping a little more accurate.

  7. Oh, and of course, every time you push a software upgrade, you can also push a new value for “lowerbound of real time” as part of the patch.

  8. A final thought: why not do the Javascript stuff on Mozilla.org or similar Foundation-owned sites? They provide a pretty good cross-section of Web users…

    You could, for example, use the JS to rewrite the name of an image to be fetched as part of the page, and then mod_rewrite all possible date/time variations of the image URL back to the same image at the server using a wildcard. Then you can get the data you need by trivial log analysis. A day or so of data gathering would suffice.