Re: [TLS] Let's remove gmt_unix_time from TLS

[[e-mail] (Martin Rex)]

Nick Mathewson wrote:
> 
> One caveat here is that a server could tell different clients that it
> had different skew values, thereby creating yet another way to set
> stealth cookies.  You'd need to be sure not to share your view of
> server-local time across anonymous sessions, while roaming in a
> privacy-conscious way, and so on.

The server could also return client-specific session IDs in ServerHello,
or it could generate client-specific (EC)DHE public keys.

They is probably little you could do against a server that is
either subverted by some three-letter-agency or malicious all by itself.

-Martin