Opened 3 years ago

Closed 23 months ago

Last modified 21 months ago

#16622 closed defect (fixed)

Spoof Timezone from Firefox patch

Reported by: mikeperry Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-torbutton-conversion, TorBrowserTeam201611R, tbb-fingerprinting
Cc: mcs, brade, arthuredelstein, gk Actual Points:
Parent ID: Points:
Reviewer: Sponsor: SponsorU

Description

We should directly patch Firefox to provide a way to spoof the timezone, instead of our hacky env var approach in Torbutton.

Child Tickets

Change History (16)

comment:1 Changed 3 years ago by mcs

Cc: mcs added
Severity: Normal

comment:2 Changed 2 years ago by gk

Sponsor: SponsorU

comment:3 Changed 2 years ago by brade

For future reference: This is currently done in torbutton_set_timezone() within torbutton.js

comment:4 Changed 2 years ago by gk

Keywords: TorBrowserTeam201608 added

Getting important SponsorU things on our August radar.

comment:5 Changed 2 years ago by bugzilla

Copied from #4545.

Angry user said:

Reveals local time of my PC instead of UTC
check out: "To Locale String" on this site: https://www.browserleaks.com/javascript

https://blog.torproject.org/blog/tor-browser-602-released#comment-191587

comment:6 Changed 2 years ago by gk

Keywords: TorBrowserTeam201609 added; TorBrowserTeam201608 removed

Tickets for September.

comment:7 Changed 2 years ago by arthuredelstein

Cc: arthuredelstein added

comment:8 Changed 2 years ago by gk

Keywords: TorBrowserTeam201610 added; TorBrowserTeam201609 removed

Moving SponsorU items to October.

comment:9 Changed 2 years ago by gk

Keywords: TorBrowserTeam201611 added; TorBrowserTeam201610 removed

Moving tickets over to November.

comment:10 Changed 2 years ago by arthuredelstein

Here's a branch that provides a static pref for timezone spoofing. I also tried to implement an alternative "live" pref, but the problem is rather complex and I don't want to delay further. I figure it's good to have a working patch now and we can revisit it during uplift.

There are two patches (pref implemented, and pref set):
https://github.com/arthuredelstein/tor-browser/commits/16622+3

Here's a patch that removes the functionality from torbutton:
https://github.com/arthuredelstein/torbutton/commit/16622

comment:11 Changed 2 years ago by gk

Keywords: TorBrowserTeam201611R added; TorBrowserTeam201611 removed
Status: newneeds_review

comment:12 Changed 23 months ago by gk

Cc: brade added

Looks good to me.

comment:13 Changed 23 months ago by gk

Cc: gk added

comment:14 Changed 23 months ago by mcs

r=mcs
This looks good to me too.

comment:15 Changed 23 months ago by gk

Resolution: fixed
Status: needs_reviewclosed

Fixed on Torbutton's master branch with commit 86dd5f30f7b6b29d6eb7e1947c225cd3cc43021b and on tor-browser-45.5.0esr-6.5-1 with commits d973b7ebaa5e93ee8e4b6b9f07ec51333687087b and 76d74d18040e22fdb6b100b4638078c2e83fa195, thanks!

comment:16 Changed 21 months ago by arthuredelstein

Keywords: tbb-fingerprinting added
Note: See TracTickets for help on using tickets.