How Can You Stop FireFox From Broadcasting Time & Date? - READ THIS!

Well something I never really considered, but since a lot of you here are into privacy, security, because you are here, I found something of interest, especially for the VPN and Tor crowd...

Most of the VPN, Tor crowd will most likely be using NoScript and this is great, but there are going to be times that you'll need to allow a site in order to have things work properly and that is where the problem begins.

So take the VPN and Tor crowd, broadcasting an IP from, as an example Germany, but you are actually in the USA, now, because you had to allow NoScript to make a website work properly, BINGO, you just allowed Firefox to broadcast the actual date and time that is on your computer, and I'd imagine, since we're talking about someone as an example in the USA, then having a date and time relating to the USA, with a German IP, LOL, well you should get that picture, because they don't add up and you are making yourself look more suspicious.

So since I never really thought about this, does anyone here know how you can disable Firefox from broadcasting the date and time of your computer online?

Oh and if you didn't think Firefox does broadcast this information, then have a look at http://www.stayinvisible.com/, of course for those running NoScript, please allow it.

JonDo also has a nice test that you can see more information the browser can reveal;

http://what-is-my-ip-address.anonymous-proxy-servers.net/


THANKS

 

I just set all machines used for privacy/anonymity stuff to UTC. The downside is that it's easy to lose track of what time it is locally

 

Sure you can change the time on your box, but I don't want to do this, LOL...

Just want to figure out how to stop Firefox is all...

 

You can't. It's not Firefox that is broadcasting date and time, web developers can use JavaScript or Flash etc to gather those info, so you either disable them by using NoScript or change the time on your computer.

 

What for?

Of course there are some timezones with relatively few people but if you live in a densely populated area I don't see the point. VPN and Tor IPs are know, everyone logging them already knows you aren't coming from where you pretend to be. It does decrease the sample size but do you seriously think this could measurably decrease your anonymity?

If you think so just change the local time, you are likely already using countless security, privacy and anonymity measures. A little inconvenience more surely won't make a difference.

 

So what you need is a world clock in place of the system clock/time.
With a feature where you can right click systray clock, choose destination country and system set's it's time there but software in tray displays your local time.

Wish there were such a program.

 

Great idea. One can make a suggestion of this software concept in the DonationCoder forum and another idea is to make a request/suggestion at the WorldTime website/forum. The former has many coders/developers just looking for new ideas to develop and the latter makes a nice World Time clock app that is already very versatile but they may be interested in adding this ability.

 

http://www.torproject.org/torbutton/torbutton-faq.html.en#securityissues

also this is much more worrying:
https://bugzilla.mozilla.org/show_bug.cgi?id=575230
and more where it came from
http://www.torproject.org/torbutton/en/design/index.html.en#FirefoxBugs

 

I call this more of drawing 'Attention' to one's self rather then reducing security, privacy or anonymity.

But the thing is, when we want to maintain, security, privacy or anonymity, do we want to draw any unneeded attention to ourselves that could possibly jeopardize any of this? Well I personally say no...

So this is why I'd like to be able to stop this....

 

You are already drawing attention to your self, by using a known Tor or VPN address!
Using UTC as your TC also draws attention because who does besides people knowing about this particular issue?

Besides, you never travel with your laptop and forget or don't bother adjusting the TC

 

Some people actually live in the UTC zone.

 

But not in the summer

(I just checked: a handful African countries appear to, didn't think of that
also, nitpicking as we are, it's not "UTC", it's WET and/or UTC+0
just doesn't make any difference
and that's why I didn't think of "that" )

 

Tor will certainly draw a lot more attention then a good VPN...

Who said anything about UTC? I'm talking about Local...

I don't know if you missed the point here, so here it is again...

You have a VPN connection that shows your IP from Germany, but the websites are seeing your local time in the USA, this is all I'm talking about, keeping things standardized...

If you're going to have a German IP and make things look as legitimate as possible on the web, then you should be showing a local time in Germany too...

Forget traveling laptops and changing the time for it or not, it's not really the point, we're talking about maintaining the best level of privacy, anonymity, and security, and doing so means having everything line up...

German IP - German Time
German IP - USA Time

 

The UTC comment was towards hierophant, sorry for the confusion.

Do you also change your HTTP_ACCEPT Headers from en to de?
You can really take it too far. Against the usual (and realistic) threat models it won't make a difference and against a dedicated attacker it doesn't neither because he'll look up your IP and see that it's a VPN, "decent" or not (btw in this regard many IPs is better ).

 

Upon reflection, and some googling, I get that using UTC doesn't work for Windows, and I apologize for missing that. In Ubuntu, using UTC instead of local time is a standard alternative. Indeed, there's the flag "UTC=[yes or no]" in /etc/default/rcS.

However, I get that "systems that dual-boot with Windows (which are generally NOT servers anyway) need UTC=no because Windows and its applications do not consistently respect RealTimeIsUniversal, therefore RTC must be localtime for the time to be consistent under Windows and its applications". See [noparse]http://ubuntuforums.org/showthread.php?t=380181[/noparse].

 

No, you can set any TC in Windows including UTC+0 without daylight saving time which is the official TC of a few West African countries.

What you are referring to is the RTC, or hardware clock or more to the point, the one you see in the BIOS.
There are two standards, one is to set the RTC to UTC and then adjust the +/- hours according to the settings of the OS. The other is to set the RTC to the local time.
(Actually there is a standard, and there is Microsoft. But nothing new there...)

Both is transparent to the OS and applications, it won't make any difference in our case. You only need to worry about this if you dual boot Windows and another OS on the hardware.
You can set Windows to UTC with a registry setting, works without any problems on Vista SP2 and up:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation]
"RealTimeIsUniversal"=dword:00000001
But be aware that this will disable the ntp syncing.

 

@katio

Thanks for the clarification. My Windows experience is largely limited to XP, and I have a lot to learn re Linux. Also, I'm embarrassed to admit that I was even more wrong -- it's only my Ubuntu servers that have time zone set to Etc/UTC. That option isn't available for Ubuntu desktops, so they're set to Europe/London.

@DasFox

Perhaps one could write a script that periodically checked IP address, and then adjusted time zone as appropriate.

 

AFAIK that's also wrong
I think Ubuntu works like this:
If it detects a Windows partition it will set UTC to no, if you install it as a single boot system it will default to UTC or maybe only on servers but you can set the /etc/rcS on both to either yes or no.

On Linux that's certainly possible with a little bash scripting and geoip-lookup which should be available in the repos.

 

I was referring to the time zone, not the hardware clock. IME, single boot Ubuntu installations always set the hardware clock to UTC. I don't recall being given a choice of UTC vs local time, in either server or desktop installations. However, in server installations, there's the option to also set the time zone to Etc/UTC. That option isn't available in desktop installations.

 

It seems with a noscript.surrogate added to firefox you should be able to block the date/time and I had the developer of NoScript give me a string to try in Firefox but I'm not having any luck with it...

So I'm still waiting on the developer...

 

Hi hierophant,

When the hardware clock is set, there are also values setup for timezone in Ubuntu desktop installations, and can also be used in Live CD usages such as the one I use. This information is probably not presented at install time, but can be manipulated none the less by a savy user.

To setup the local timezone for example with EDT/EST:

Code:

rm /etc/localtime
# setup for EDT and EST (+4 EDT; +5 EST)
ln -s /usr/share/zoneinfo/EST4EDT /etc/localtime
# setup for only EST (+5 EST)
# ln -s /usr/share/zoneinfo/EST /etc/localtime
rm /etc/timezone
echo "US/Eastern" > /etc/timezone
export TZ="/usr/share/zoneinfo/America/New_York"

Then, if you have an atomic watch (like I do), if the computer time drifts after power downs, then set the hardware clock to UTC with the command:

Code:

date -u MMDDHHmm

Effectively, for Eastern timezone, then the time you would set would be the UTC time which is +5 hours ahead of Eastern time.

Similarly, any timezone can be set by the user on an installed system or Live CD session (as root).

As for the thread topic to prevent Firefox from broadcasting Time and Date - I do not know if that is possible since in order to do that the technique would probably have to elimiate time and date from the http protocol which probably always carries a time and date (TCP-wise) that is required by the protocol. However, if the timezone and hardware clock time is spoofed to present another timezone/localtime, then effectively the real hardware clock/timezone is not present in the protocol.

-- Tom

 

@DasFox

Please post the noscript.surrogate when you get it working. That's very cool.

@Tom

Thank you. One can set time zone in Ubuntu desktop installations. It's just that Etc/UTC isn't an option. However, I see that UTC appears in /usr/share/zoneinfo/ on both servers and desktops. I get the feeling that developers are discouraging the use of UTC for time zone, and more so on desktops than on servers. Anyway, sorry to beat this into the ground so thoroughly.

 

Hi hierophant,

On Ubuntu 10.10 Live CD, there exists /usr/share/zoneinfo/Etc/UTC.

When I issue the command: file UTC in /usr/share/zoneinfo/Etc, it outputs:
UTC: timezone data, version 2, 1 gmt time flag, 1 std time flag, no leap seconds, no transition times, 1 abbreviation char

Looks like it will work if you try it. Or, you could try GMT.

-- Tom