kkapsner / CanvasBlocker

A Firefox extension to protect from being fingerprinted.
https://canvasblocker.kkapsner.de
Mozilla Public License 2.0
1.14k stars 86 forks source link

TimeZone Spoofing based on IP address #557

Open DGjone44 opened 3 years ago

DGjone44 commented 3 years ago

Looking for feature to Change TimeZone/Spoof Time Zone based on IP address. Current addon I am using is Chameleon from Serenblue. This extension query IP address from online database to convert IP to TimeZone.

image

image

image

image

Happy to donate $20 to your BTC address at main page.

kkapsner commented 3 years ago

Timezone faking is very complex (I'm not sure if it's even completely possible). I just ran a very quick test with Chameleon and it managed to fake getTimezoneOffset but failed to fake the generated date string (@sereneblue): image

So what is your exact use case? Do you use a VPN and want to match the timezone you are leaving it?

DGjone44 commented 3 years ago

Timezone faking is very complex (I'm not sure if it's even completely possible). I just ran a very quick test with Chameleon and it managed to fake getTimezoneOffset but failed to fake the generated date string (@sereneblue): image

So what is your exact use case? Do you use a VPN and want to match the timezone you are leaving it?

Thanks for testing my supplied reference app. Yes I used vpn to test something and IP location changes. Matching timezone.

DGjone44 commented 3 years ago

While checking with https://whoer.net/#extended it always shows System and Local time is matched. (While using @sereneblue /Chameleon app)

sereneblue commented 3 years ago

Timezone faking is very complex (I'm not sure if it's even completely possible).

I agree with the above. It's not possible to really spoof this using webextensions. The best alternative is to launch Firefox with a modified timezone environment variable on Linux. (maybe possible on Windows?). What was wrong with the generated string?

kkapsner commented 3 years ago

@sereneblue: you're right. The text is consistent but I selected HST timezone... so the timezone spoofing is not working at all at the moment or did I do something wrong? I just selected a timezone in the browser action popup.

sereneblue commented 3 years ago

@sereneblue: you're right. The text is consistent but I selected HST timezone... so the timezone spoofing is not working at all at the moment or did I do something wrong? I just selected a timezone in the browser action popup.

It looks like you're testing on 127.0.0.1? Chameleon is disabled for private IPs/localhost.

kkapsner commented 3 years ago

Ah... did not know that.

OK - then here is my point how chameleon does not protect your timezone:

function twoDiggits(num){return num >= 10? num.toFixed(0): "0" + num.toFixed(0);}
var now = new Date();
var today = now.getFullYear() + "-" + twoDiggits(now.getMonth() + 1) + "-" + twoDiggits(now.getDate())
alert((new Date(today + " 00:00:00") - new Date(today)) / 60000);

... and then there are web workers...

PS: you're leaking that you modified the functions: Function.prototype.toString.call(Date);

sereneblue commented 3 years ago

Ah... did not know that.

OK - then here is my point how chameleon does not protect your timezone:

function twoDiggits(num){return num >= 10? num.toFixed(0): "0" + num.toFixed(0);}
var now = new Date();
var today = now.getFullYear() + "-" + twoDiggits(now.getMonth() + 1) + "-" + twoDiggits(now.getDate())
alert((new Date(today + " 00:00:00") - new Date(today)) / 60000);

... and then there are web workers...

PS: you're leaking that you modified the functions: Function.prototype.toString.call(Date);

Thanks for pointing those out. I'll look into the first issue but not sure if there's actually anything that can be done about it. The second issue should be resolved in a future update.

Irvinehimself commented 2 years ago

As suggested by @sereneblue, according to the Arch Firefox Wiki, you can set the time-zone for the browser to match the VPN output portal by setting the time-zone for the app like so : TZ=UTC firefox.

What I normally use, either in a .desktop file or from the terminal is: TZ=<tz> firefox -P <profile> --new-instance

Since I use Network Manager, nmcli connection show --active | grep "vpn" would give me the current VPN certificate. From that I could deduce the time-zone. In other words, it would be fairly trivial to write a small script to automatically launch a Firefox instance with a time-zone matching the current VPN portal.

Although, having said that, since VPNs are now fairly ubiquitous and websites know when you are using one, matching time-zone to VPN output portal seems like a lot of work for little gain. The whole idea is to hide amongst the masses. In other words, you want a time zone with the largest possible population matching your browser's other characteristics.

I have no idea how to do the above in Windows?

edited for spelling and grammar