1

I understand the Tor Browser uses the UTC timezone but what about the tor daemon? Should I change the timezone on my ubuntu laptop to UTC to help make my tor traffic less fingerprintable? It wouldn't effect my workflow too much. And I could probably hack together a conky profile to display my actual time.

Where can I find documentation on the tor daemon timezone stuff? Any advise or documentation would be helpful.

Many thanks!

EDIT: oh! would changing my timezone negatively effect my VPN usage? I usually connect to VPN first, then use tor. I know using VM/NAT is the safer alternative to changing my host timezone altogether. But I'm usually out with my smallest laptop (only 2GB RAM). VM isn't the most resource friendly option right now, even with xfce.

Improve this question

2 Answers 2

Reset to default
1

The Tor daemon doesn't leak timezone, if it did it would split users anonymity sets. Relays shouldn't be able to distinguish sets of users, this would allow them to and would break some of the protections of the Tor network.

However, if you use other applications with Tor you may wish to set your timezone to UTC. This is a protection that anonymous operating systems, like Tails, use to reduce the risk posed by any such leaks.

Most, if not all, computers work in UTC. Only users are concerned with timezone, so it's only user facing aspects of it that would be affected. For example, the Tor daemon doesn't leak your timezone as any part of the protocol but the log it outputs does because the user has to understand the timestamps on the events that it logs.

Improve this answer
7
  • correct me if I'm wrong but all the logs are about to be stripped and/or obfuscated before publishing everywhere in open public? The only thing matters when you're publishing the log is a sequence of actions and - only in some cases - a precise timings between records are kept.
    – Alexey Vesnin ♦
    Commented Dec 30, 2016 at 9:36
  • Logs are prefixed with a localtime. The users timezone can potentially be determined from the logs. This can help distinguish or geographically locate the user.
    – cacahuatl
    Commented Dec 30, 2016 at 10:18
  • how can local time will be guessed or extracted when dates and times from logs are substituted during obfuscation? I.e. in line like 05/11/2016 01:02:03 Log record goes here I replace it with 12/17/203 14:15:16 Log record goes here ? In the log record, of course, all the timezone-related info is wiped out too. How? Enlighten us, please...
    – Alexey Vesnin ♦
    Commented Dec 30, 2016 at 13:06
  • If you manually replace the timestamps? Of course it doesn't. That's really not the point though, is it?
    – cacahuatl
    Commented Dec 30, 2016 at 17:07
  • so - if we have a case of a raw/uncaring copy-and-paste - then it's a leak by itself, even if it's not the logs. If the log is pre-obfuscated - then it's not a problem and you're wrong, man
    – Alexey Vesnin ♦
    Commented Dec 30, 2016 at 17:19
-1

You can do it. Timezone is - actually - not a personal and/or fingerprinting data, i.e. I can have a GMT+5 TZ when I'm physically in GMT-1 one. UTC seems to be quite a normal choice, but you can safely use your convinient and/or real timezone. The profile usage you're speaking about is much greater deanonymising factor, that's where you should worry about leaks. A browser - via in-page JS or add-on JS can potentially leak your timezone, and it's basically not a problem. Make sure that you're running it on chrooted isolated unprivileged user - so you won't leak anything sensible.

Improve this answer
6
  • It is a problem, which is why Tor Browser works to defeat timezone and locale fingerprinting.
    – cacahuatl
    Commented Dec 26, 2016 at 5:24
  • @canonizingironize please don't mix beer with bear... Locale leak is an issue, and in this question we are not speaking about locales at all. timezone is not a problem, actually - read my answer, there's "why"
    – Alexey Vesnin ♦
    Commented Dec 26, 2016 at 12:58
  • Splitting your anonymity set is an issue for anonymity.
    – cacahuatl
    Commented Dec 26, 2016 at 16:43
  • It is a problem, bypass or not. If it wasn't a problem then bypasses wouldn't be an issue. You argue against your own point, if it can be bypassed then it is important that it is set to UTC to improve your anonymity set.
    – cacahuatl
    Commented Dec 27, 2016 at 3:18
  • 1
    You've still not addressed the point that timezone leaks split anonymity sets and are harmful.
    – cacahuatl
    Commented Dec 27, 2016 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .