Does TOR leak time and time zone which can expose the approximate user location on earth?

I think some JavaScript codes in web pages, asks operating system time before submitting the web form.

Does TOR browser change or hide the system time in any way?


Yes, it does.

Tor Browser uses UTC for it's time. This hides the "system time" from any querying websites and stops any website that could read the time from determining your location based on your timezone.

However it is not able to protect users whose time is uniquely inaccurate. You should use some timesync mechanism to ensure that you keep your system time accurate with reference time, through NTP or similar mechanisms.

Disabling Javascript would stop all access to the ability of a website to query the system time.

From the Tor Browser Design Specification:

Timezone and Clock Offset

While the latency in Tor connections varies anywhere from milliseconds to a few seconds, it is still possible for the remote site to detect large differences between the user's clock and an official reference time source.

Design Goal: All Tor Browser users MUST report the same timezone to websites. Currently, we choose UTC for this purpose, although an equally valid argument could be made for EDT/EST due to the large English-speaking population density (coupled with the fact that we spoof a US English user agent). Additionally, the Tor software should detect if the users clock is significantly divergent from the clocks of the relays that it connects to, and use this to reset the clock values used in Tor Browser to something reasonably accurate. Alternatively, the browser can obtain this clock skew via a mechanism similar to that used in tlsdate.

Implementation Status: We set the timezone using the TZ environment variable, which is supported on all platforms.

While Tor, the network protocol, is agnostic to the data sent over it Tor Browser takes steps to avoid being fingerprintable.

| improve this answer | |
  • Thanks for your help. What do you mean by "uniquely inaccurate"? Do you mean all TOR users should set system time to UTC +0? – John Bernard Dec 21 '16 at 20:40
  • 1
    No, the issue is if your time is wrong, the timezone is masked anyway. Lets say it was exactly 7 minutes and 30 seconds out of sync with the proper time. If I could check each users time and measure how inaccurate their time was I could link your browsing together by seeing if later users are also exactly 7 minutes and 30 seconds out of sync with the actual time. – cacahuatl Dec 22 '16 at 1:31
  • Thanks. I see. Is Windows 10 utilities correct enough for time sync requirements? Or do I need to install another software? – John Bernard Dec 23 '16 at 16:17
  • Windows does it's own time synchronisation through NTP, by default against a Windows time server or it can be configured to be a custom server. This means it will regularly synchronise its time with a reference clock and should provide accurate time automatically. – cacahuatl Dec 23 '16 at 22:25

NO, it does not do this. But scripts can't be filtered for a stuff like this - even in other browsers and/or NodeJS sandbox. What is available to script - can be used by it in any way, and there's nothing you can do about it: real-time code analysis is bloody expensive and fails sometimes on platforms with the runtime-modifiable code. If you don't trust a script on a specific page - disable scripts completely. In your particular case - form submission is a basic HTML function, so it won't be affected by disabling scripts.

| improve this answer | |
  • Thanks Alexey. Other than Javascript, how does TOR prevent time leakage? Simply time information is not transmitted via HTTP requests so there is no special measure to prevent time leakage? – John Bernard Dec 20 '16 at 21:58
  • If there's nothing encapsulated into HTTP and/or added/altered headers - you're correct. The browser add-ons are another leak source: this code is not runtime-controlled too, because the Tor Browser is a Firefox. To prevent time leaks completely - use a VM with browser. It's impossible - even via zero-day exploits - to access a host hypervisor in Virtualbox or Xen from within a browser running under unprivileged and sandboxed user, Root-launched browser can be potential leak source via code execution: guest addon module can potentially be communicated with – Alexey Vesnin Dec 20 '16 at 23:05
  • How do you imagine an HTML form accesses local time and timezone settings without access to the javascript API? – cacahuatl Dec 21 '16 at 5:18
  • Exactly the point, @canonizingironize !It can't access anything without JavaScript API, and it's sent separately, by browser itself. So you can disable all scripts and be able to send the form. the only way is browser add-on that can set some hidden value – Alexey Vesnin Dec 21 '16 at 5:55
  • 1
    The specific clarity can be argued all day. Other users can confirm the answer as correct or not by voting up or down. – Andrew Lott Jan 9 '17 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.