title: practical security ramifications of increasing WCF clock skew to more than an hour
body: <p>I have written a WCF service that returns 'semi-private' data concerning peoples name, addresses and phone numbers. By semi-private, I mean that there is a username and
  password to access the data, and the data is meant to be secured in transit. However,
  IMHO noone is going to expend any energy trying to obtain the data, as it is mostly available
  in the public phone book anyway etc. At some level, the security is a bit of security 'theatre' to tick some boxes imposed on us by government entities.</p>
  
  <p>The client end of the service is an application which is given out to registered
  'users' to run within their own IT setups. We have no control over the IT
  of the users - and in fact they often tell us to 'go jump' if we put too many
  requirements on their systems.</p>
  
  <p>One problem we have been encountering is numerous users that have system clocks
  that are not accurate. This can either be caused by a genuine slow/fast clocks, or
  more than likely a timezone or daylight savings zone error (putting their
  machine an hour off the 'real' time). A feature of the WCF bindings we are
  using is that they rely on the notion of time to detect replay attacks etc.</p>
  
  <pre><code> &lt;wsHttpBinding&gt;
      &lt;binding name="normalWsBinding" maxBufferPoolSize="524288" maxReceivedMessageSize="655360"&gt;
        &lt;reliableSession enabled="false" /&gt;
        &lt;security mode="Message"&gt;
          &lt;message clientCredentialType="UserName" negotiateServiceCredential="false"
            algorithmSuite="Default" establishSecurityContext="false" /&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/wsHttpBinding&gt;
  </code></pre>
  
  <p>The inaccurate client clocks cause security exceptions to be thrown and
  unhappy users.</p>
  
  <p>Other than suggesting users correct their clocks, we know that we can
  increase the clock skew of the security bindings.</p>
  
  <p><a href="http://www.danrigsby.com/blog/index.php/2008/08/26/changing-the-default-clock-skew-in-wcf/" rel="nofollow noreferrer">http://www.danrigsby.com/blog/index.php/2008/08/26/changing-the-default-clock-skew-in-wcf/</a></p>
  
  <p>My question is, what are the real practical security ramifications of
  increasing the skew to say 2 hours? If an attacker can perform some
  sort of replay attack, why would a clock skew window of 5 minutes
  be necessarily safer than 2 hours? I presume performing any
  attack with security mode of 'message' requires more than just
  capturing some data at a proxy and sending the data back in again
  to 'replay' the call? In a situation like mine where data is
  only 'read' by the users, are there indeed any security ramifications
  at all to allowing 'replay' attacks?</p>