JavaScript time fingerprinting

[sheep]

It’s the time set by sdwdate, which is the median time of three servers chosen randomally from whonix’s list. Correct, JS has access to that.

@madaidan

This could be used for fingerprinting as an attacker can determine the difference in clock skews and offsets from other users

sdwdate mitigates that to some extent, but I agree, not fully. Not between one setting and another. Indeed JS makes fingerprinting way easier.

@madaidan

may also be able to determine your location by checking which countries have a similar time as you.

Since it’s UTC time in all Whonix machines that won’t be possible.

By the way, it’s possible to set other timezones:

Setting system timezone

Continuing with UTC as default, can we add an option to set the system time to another timezone? Motivation: Make it more difficult for a site to classify origin as Whonix user in some case. E.g. Japanese site that receives Tor traffic in Japanese timezone but sees the host has UTC timezone. Can be a UK-based Japanese staying up at nights, otherwise a Japan-based Whonix user. In Tor before VPN setup, the site observes server (VPN) time is different than host time. That can be a reason to dis…