929066 - Handle minor clock skew when generating BrowserID certificates and assertions

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: Android Sync, defect)

Description

[Nick Alexander :nalexander [he/him]]

A little clock skew (single-digit seconds) is very common between my laptop, Android device, and the multiple servers involved with generating an FxAccount certificate and exchanging for a token server token.

This ticket is a stop-gap; we will probably need to do more before we go to production.  I've filed tickets for the relevant servers at [1] and [2].


[1] https://github.com/mozilla/picl-idp/issues/233
[2] https://github.com/mozilla/picl-oldsync/issues/3

Comment 1

[Nick Alexander :nalexander [he/him]]

Attachment: Stop-gap allowing for local clock skew.

Comment 2

[Nick Alexander :nalexander [he/him]]

Comment on attachment 819879 [details] [review]
Stop-gap allowing for local clock skew.

This patch is a truly terrible idea.  As written, it generates certificates 20 seconds in the past, and assertions 10 seconds in the past.  This works when we generate both locally, which is common in testing.  In the wild, we will *never* generate certificates... so this introduces a 10 second or so window of instability.  Live and learn.

Comment 3

[Richard Newman [:rnewman]]

Attachment: Proposed patch. v1

Untested. Thoughts?

Comment 4

[Richard Newman [:rnewman]]

https://hg.mozilla.org/services/services-central/rev/07195f5c3eb3

If this worked, incidence of timing-related auth failures should be reduced. Nick, please let me know when you try a build!

Comment 5

[Richard Newman [:rnewman]]

https://hg.mozilla.org/mozilla-central/rev/07195f5c3eb3

Comment 6

[Nick Alexander :nalexander [he/him]]

Comment on attachment 8362029 [details] [review]
Proposed patch. v1

This landed a while back.  And is good!