Tor Browser file timestamp

Support
1

I notice that all the files of Tor Browser have timestamp 2000-01-01 00:00:00 +0000.

What is the reason for this?

1 Like
2

Probably to prevent metadata leaks.

3

Probably reproducible builds.

reference:

1 Like
4

Probably to prevent metadata leaks.

How do such leaks work?

Probably reproducible builds.

Is this what you mean?

When looking for other info, I have seen in the source code of Tails that they explicitly run find ... -exec touch --date="${tbb_timestamp}" "{}" \;. That, however, will obviously work only for files, as dirs’ timestamps will change.

What I am actually interested in is if and how unified timestamps contribute to TB’s project goal.

1 Like
5

Yes.

Reproducible builds.

See also:

1 Like
6

Thanks.

By project goal I mean anonymity, i.e. I wonder if it has any direct relation to it or if it is just a technical detail of the reproducible build technology (which itself is a tool towards the project goal).

To put it differently - is one less anonymous if one changes the timestamps and how exactly (if yes)?

I am asking this because, as discussed, web JS and extensions have no direct access to local files anyway.

1 Like
7

Required technical detail to accomplish reproducible builds.

Nobody ever made such an argument to my knowledge.

2 Likes
8

In the case that your Tor Browser (session) is compromised, an attacker may be able to determine various metadata about the user that may lead to deanonymization. For example, if you decide to change your operating system’s date, time, and time zone, then modify files, an attacker could use that information to build a profile of you, if not done so already. The most valuable metadata would be time zone, as that isolates a user to specific regions.

9

In the case that your Tor Browser (session) is compromised

How exactly does this happen?

an attacker may be able to determine various metadata about the user that may lead to deanonymization.

But website JS and extensions have no direct access to local files.

Please explain the actual attack scenario.

1 Like
10

There are many attack vectors, from privilege escalation of Tor Browser itself to crafting malicious downloaded files that report home when opened.

11

privilege escalation of Tor Browser

How exactly does this work?

malicious downloaded files that report home when opened.

Such malware can read any other file, not just TB’s. So, that seems unrelated.

1 Like
12

I will let you know once I have the opportunity to learn and practice penetration testing myself.