Meta has added Network Time Security (NTS) to its public time service and open-sourced its implementation, giving compatible devices a way to check that time responses are genuine and unaltered. Accurate, authenticated time helps keep certificates, tokens and other security checks from trusting a clock an attacker has quietly changed.
Meta AI Watch analysis
What happened
In a post published on 6 October, Meta Engineering says its NTS service uses nts.meta.com for the initial key exchange, then directs clients to time.meta.com for authenticated time responses. Meta has also open-sourced the protocol, server and client through its Meta Time library.
For administrators using chrony, Meta gives this configuration line: pool nts.meta.com nts iburst maxsources 5. The pool setting creates several independent time-source associations rather than relying on a single responder.
Why it matters
Ordinary Network Time Protocol (NTP) has no built-in authentication, so a network attacker can try to forge a time response. A clock pushed backwards could make expired certificates or credentials appear valid; pushed forwards, it could make valid ones expire at once. NTS helps stop an attacker from lying about the contents of a response.
It is not a magic clock shield. Meta notes that an attacker can still delay or drop packets, and NTS cannot rescue a device whose clock is too far wrong to establish its initial TLS connection. Multiple time sources and sensible checks still matter. Authentication proves who supplied a response, not that the authenticated server is infallible.
Our read
This is useful infrastructure work, not a shiny new feature for a home screen. Making secure time easier to deploy can strengthen the checks that rely on it, while an open implementation gives system administrators and client developers something concrete to use. If you run chrony, Meta’s example is a practical starting point; for everyone else, the important distinction is that authenticated time resists forged answers, not every way a clock can go astray. Meta’s NTS announcement and configuration guidance has the implementation details.
What to watch
- Whether more NTP clients and operating systems add or enable NTS support.
- How operators combine authenticated time with multiple independent sources and clock sanity checks.
- Whether other public time services adopt compatible NTS endpoints.
Discussion spark: Should authenticated time become the default expectation for internet-connected devices, even if supporting it adds work for client and service operators?
Sources and evidence
- NTS: Authenticated Time at Meta (6 October 2026, 16:00 UTC)
not affiliated with, endorsed by, or operated by Meta