During launch, Tor Browser opens /usr/share/zoneinfo/(continent)/(city)

Why? How can I hide that info?

  • 1
    i think time and timezone is needed for a cert checking and keeping HTTP Connection with some service is important - some APIs and Site refuse connections with an old/invalid timestamp (especially microsoft server sites)
    – bMalum
    Jul 26 '15 at 11:07
  • I've just run a couple of experiments using strace, and can't reproduce what you're seeing (I'm possibly passing the wrong flags to the tool... ). How did you show that the timezone file was being read? Jul 27 '15 at 19:49
  • I was running a tool that lists all system calls related to files because I get a message about not beinG able to access a file, but the message won't give me the filename. So in the output, I see all the fstat and open calls. The zone file is there (but it's not the one with the error).
    – WGroleau
    Jul 29 '15 at 11:07
  • The tool is fs_usage. I don't know that it is reading the file, just that it opens the file. Or maybe it's a directory.
    – WGroleau
    Jul 29 '15 at 11:14
  • bMalum, that makes sense; and even if it only needs time, the system call to read the clock would probably open the zone file to correctly convert from UTC.
    – WGroleau
    Jul 29 '15 at 11:17

Tor needs to know the system timezone in order to convert the system time (which on macOS, is in the UTC timezone) into the local timezone, when producing log messages. Even though Tor Browser doesn't show these messages to the user by default, Tor still generates them.

This shouldn't be a security problem because these log messages are not sent out on the network. Also Tor Button hides the timezone from Javascript running in the browser.

Nevertheless you can tell Tor that you are using the UTC timezone and so it won't need to look up your local timezone. You can do this by setting the TZ environment variable to UTC.

Here's starting Tor Browser normally from Terminal

$ open -a /Applications/TorBrowser.app

and if we look at what files Tor opens (note that in Tor Browser, the Tor executable is called tor.real)

$ sudo fs_usage -w tor.real | tee tor.fs_usage.noTZ
$ grep -i zone tor.fs_usage.noTZ
14:23:50.730491  access                       (R___)    /usr/share/zoneinfo/Europe/London
14:23:50.730518  open              F=4        (R_____)  /usr/share/zoneinfo/Europe/London
14:23:52.443077  open              F=23       (R_____)  /usr/share/zoneinfo/UTC

Now let's start Tor Browser with the timezone set to UTC

$ TZ=UTC open -a /Applications/TorBrowser.app

and we see that now the local timezone file is not requested. Of course as a consequence log messages from Tor will be in UTC rather than the local timezone, so may lead to confusion.

$ sudo fs_usage -w tor.real | tee tor.fs_usage.TZ
$ grep -i zone tor.fs_usage.TZ 
14:28:57.774788  open              F=4        (R_____)  /usr/share/zoneinfo/UTC
14:28:59.442112  open              F=23       (R_____)  /usr/share/zoneinfo/UTC

Firefox itself also accesses the timezone information in a similar way, so setting the TZ environment variable to UTC also results in the firefox executable only looking up the UTC timezone file.

Setting TZ=UTC shouldn't cause any problem for checking certificate expiry on macOS, since certificates store the start and end dates in the UTC timezone and so can be directly compared to the macOS (and Linux/*BSD) system clock.

Windows is more of a problem because it keeps the system time on the local timezone so the timezone needs to be known in order to get the UTC time. I'm not sure what will happen here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.