cross-posted from: https://lemmy.world/post/31789847
Browser Timezone & Privacy Concerns
How can I hide my "timezone" from sniffing sites?
From my understanding, websites can access both the timezone of my browser (without using javascript) and the timezone of my local machine (using javascript). my question being
- If a website has access to my local machine's timezone, does it mean it has access to other information on/about my local machine?
- According to Privacy - How can I hide my "timezone" from sniffing sites? - Super User, we must disable JavaScript to block timezone access. However disabling javascript is not really feasible as it breaks most of websites. Is there a workaround that allows us to block JavaScript from running specific commands?
- Maybe my understanding of JavaScript is incorrect, but if a website has the privilege of running any program on my computer through the web browser, it can retrieve all the information it needs. If I don't disable JavaScript while using the browser, I don't see the point in resisting fingerprinting, like spoofing my device info.
appreciate any help!
Please see the cross-post as it is updated.
First of all, fingerprinting isn't that precise. It's extremely overrated, because instilling fear gets clicks and views. You can't use the browser fingerprint for authentication, for example, because even though there are enough bits in theory, they are not random and not unique and a lot of people end up having the same exact fingerprint, for example, if they use company PCs where everyone gets the exact same PC and plugins/extensions are enforced with group policy.
However, the JS running in the browser is limited and sandboxed. It cannot do everything and can't access everything. But among the few things it can actually do is prompting for the timezone offset and transferring it to a permitted site, like the one the JS app is running on. If you feel stalked by ad companies fingerprinting you and you have JS enabled, that's unfortunately something you have to accept, unless you run your browser in an environment with a different timezone, but then all times on sites you visit and in its history, will appear off. For example, in Linux, you could achieve that by setting the TZ environment variable in the environment you start the browser in. If that environment is a shell script, it can be temporary and just for the browser while it's running. A script could even be made to pick a random TZ on every browser start, to confuse fingerprinters.
thanksalot
Except for timezone, what else information can sandboxed JS get from a local machine?
A lot. A few I can think of: Locale, Window.devicePixelRatio, Window.history (per domain limited access), various Window and screen size properties and various browser and system properties and settings (like browser name, vendor, RAM, etc) see https://developer.mozilla.org/en-US/docs/Web/API/Navigator for more info.
I see
thanksalot