1

I understand the Tor Browser uses the UTC timezone but what about the tor daemon? Should I change the timezone on my ubuntu laptop to UTC to help make my tor traffic less fingerprintable? It wouldn't effect my workflow too much. And I could probably hack together a conky profile to display my actual time.

Where can I find documentation on the tor daemon timezone stuff? Any advise or documentation would be helpful.

Many thanks!

EDIT: oh! would changing my timezone negatively effect my VPN usage? I usually connect to VPN first, then use tor. I know using VM/NAT is the safer alternative to changing my host timezone altogether. But I'm usually out with my smallest laptop (only 2GB RAM). VM isn't the most resource friendly option right now, even with xfce.

1

The Tor daemon doesn't leak timezone, if it did it would split users anonymity sets. Relays shouldn't be able to distinguish sets of users, this would allow them to and would break some of the protections of the Tor network.

However, if you use other applications with Tor you may wish to set your timezone to UTC. This is a protection that anonymous operating systems, like Tails, use to reduce the risk posed by any such leaks.

Most, if not all, computers work in UTC. Only users are concerned with timezone, so it's only user facing aspects of it that would be affected. For example, the Tor daemon doesn't leak your timezone as any part of the protocol but the log it outputs does because the user has to understand the timestamps on the events that it logs.

  • correct me if I'm wrong but all the logs are about to be stripped and/or obfuscated before publishing everywhere in open public? The only thing matters when you're publishing the log is a sequence of actions and - only in some cases - a precise timings between records are kept. – Alexey Vesnin Dec 30 '16 at 9:36
  • Logs are prefixed with a localtime. The users timezone can potentially be determined from the logs. This can help distinguish or geographically locate the user. – cacahuatl Dec 30 '16 at 10:18
  • how can local time will be guessed or extracted when dates and times from logs are substituted during obfuscation? I.e. in line like 05/11/2016 01:02:03 Log record goes here I replace it with 12/17/203 14:15:16 Log record goes here ? In the log record, of course, all the timezone-related info is wiped out too. How? Enlighten us, please... – Alexey Vesnin Dec 30 '16 at 13:06
  • If you manually replace the timestamps? Of course it doesn't. That's really not the point though, is it? – cacahuatl Dec 30 '16 at 17:07
  • so - if we have a case of a raw/uncaring copy-and-paste - then it's a leak by itself, even if it's not the logs. If the log is pre-obfuscated - then it's not a problem and you're wrong, man – Alexey Vesnin Dec 30 '16 at 17:19
-1

You can do it. Timezone is - actually - not a personal and/or fingerprinting data, i.e. I can have a GMT+5 TZ when I'm physically in GMT-1 one. UTC seems to be quite a normal choice, but you can safely use your convinient and/or real timezone. The profile usage you're speaking about is much greater deanonymising factor, that's where you should worry about leaks. A browser - via in-page JS or add-on JS can potentially leak your timezone, and it's basically not a problem. Make sure that you're running it on chrooted isolated unprivileged user - so you won't leak anything sensible.

  • It is a problem, which is why Tor Browser works to defeat timezone and locale fingerprinting. – cacahuatl Dec 26 '16 at 5:24
  • @canonizingironize please don't mix beer with bear... Locale leak is an issue, and in this question we are not speaking about locales at all. timezone is not a problem, actually - read my answer, there's "why" – Alexey Vesnin Dec 26 '16 at 12:58
  • Splitting your anonymity set is an issue for anonymity. – cacahuatl Dec 26 '16 at 16:43
  • It is a problem, bypass or not. If it wasn't a problem then bypasses wouldn't be an issue. You argue against your own point, if it can be bypassed then it is important that it is set to UTC to improve your anonymity set. – cacahuatl Dec 27 '16 at 3:18
  • 1
    You've still not addressed the point that timezone leaks split anonymity sets and are harmful. – cacahuatl Dec 27 '16 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.