3

Does TOR leak time and time zone which can expose the approximate user location on earth?

I think some JavaScript codes in web pages, asks operating system time before submitting the web form.

Does TOR browser change or hide the system time in any way?

Improve this question
1
  • While hiding time is ok for privacy. what can be done to access websites that require your browser to show the expected times/timezones? In my case, the website is non-responsive until I fix the issue: "Your computer's timezone does not seem to match your account's timezone setting of India/New Delhi"
    – user34148
    Commented Feb 17, 2022 at 16:07

3 Answers 3

Reset to default
2

No, Tor does not leak your time zone.

Tor Browser uses UTC for its time. This hides the "system time" from any querying websites and stops any website that could read the time from determining your location based on your timezone.

However it is not able to protect users whose time is uniquely inaccurate. You should use some timesync mechanism to ensure that you keep your system time accurate with reference time, through NTP or similar mechanisms.

Disabling Javascript would stop all access to the ability of a website to query the system time.

From the Tor Browser Design Specification:

Timezone and Clock Offset

While the latency in Tor connections varies anywhere from milliseconds to a few seconds, it is still possible for the remote site to detect large differences between the user's clock and an official reference time source.

Design Goal: All Tor Browser users MUST report the same timezone to websites. Currently, we choose UTC for this purpose, although an equally valid argument could be made for EDT/EST due to the large English-speaking population density (coupled with the fact that we spoof a US English user agent). Additionally, the Tor software should detect if the users clock is significantly divergent from the clocks of the relays that it connects to, and use this to reset the clock values used in Tor Browser to something reasonably accurate. Alternatively, the browser can obtain this clock skew via a mechanism similar to that used in tlsdate.

Implementation Status: We set the timezone using the TZ environment variable, which is supported on all platforms.

While Tor, the network protocol, is agnostic to the data sent over it Tor Browser takes steps to avoid being fingerprintable.

Improve this answer
4
  • Thanks for your help. What do you mean by "uniquely inaccurate"? Do you mean all TOR users should set system time to UTC +0?
    – John Bernard
    Commented Dec 21, 2016 at 20:40
  • 1
    No, the issue is if your time is wrong, the timezone is masked anyway. Lets say it was exactly 7 minutes and 30 seconds out of sync with the proper time. If I could check each users time and measure how inaccurate their time was I could link your browsing together by seeing if later users are also exactly 7 minutes and 30 seconds out of sync with the actual time.
    – cacahuatl
    Commented Dec 22, 2016 at 1:31
  • Thanks. I see. Is Windows 10 utilities correct enough for time sync requirements? Or do I need to install another software?
    – John Bernard
    Commented Dec 23, 2016 at 16:17
  • Windows does it's own time synchronisation through NTP, by default against a Windows time server or it can be configured to be a custom server. This means it will regularly synchronise its time with a reference clock and should provide accurate time automatically.
    – cacahuatl
    Commented Dec 23, 2016 at 22:25
1

TOR client leaks your data when it sync's its clock to start. This is a very bad thing to do, its how your traced, its a trigger. Time sync should be Decoupled from Security.

Also dont ask for TOR bridges with Gmail or telegram, both data mined, might as well just email NSA direct.

Improve this answer
-1

NO, it does not do this. But scripts can't be filtered for a stuff like this - even in other browsers and/or NodeJS sandbox. What is available to script - can be used by it in any way, and there's nothing you can do about it: real-time code analysis is bloody expensive and fails sometimes on platforms with the runtime-modifiable code. If you don't trust a script on a specific page - disable scripts completely. In your particular case - form submission is a basic HTML function, so it won't be affected by disabling scripts.

Improve this answer
7
  • Thanks Alexey. Other than Javascript, how does TOR prevent time leakage? Simply time information is not transmitted via HTTP requests so there is no special measure to prevent time leakage?
    – John Bernard
    Commented Dec 20, 2016 at 21:58
  • If there's nothing encapsulated into HTTP and/or added/altered headers - you're correct. The browser add-ons are another leak source: this code is not runtime-controlled too, because the Tor Browser is a Firefox. To prevent time leaks completely - use a VM with browser. It's impossible - even via zero-day exploits - to access a host hypervisor in Virtualbox or Xen from within a browser running under unprivileged and sandboxed user, Root-launched browser can be potential leak source via code execution: guest addon module can potentially be communicated with
    – Alexey Vesnin ♦
    Commented Dec 20, 2016 at 23:05
  • How do you imagine an HTML form accesses local time and timezone settings without access to the javascript API?
    – cacahuatl
    Commented Dec 21, 2016 at 5:18
  • Exactly the point, @canonizingironize !It can't access anything without JavaScript API, and it's sent separately, by browser itself. So you can disable all scripts and be able to send the form. the only way is browser add-on that can set some hidden value
    – Alexey Vesnin ♦
    Commented Dec 21, 2016 at 5:55
  • 1
    The specific clarity can be argued all day. Other users can confirm the answer as correct or not by voting up or down.
    – Andrew Lott
    Commented Jan 9, 2017 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .