how can I hide my "timezone" from sniffing sites?

Some sites I surf and register an account on, can find my location by the "timezone" set on windows, I use Chrome, so how can I block their access to actual timezone ?

Edit: Sorry, Forgot to mention that I use VPN with UK IP, so until recently I always surfed internet like an English, till recently that I found out some sites can know your actual location by your Time-zone.

You can test it yourself: go and register and account on ifttt.com with some VPN / proxy, then go to your account and see that they set your location not by IP, but via your time zone!

The actual problem I had was with some sites that restrict some regions from their service so although you have a VPN with proper IP but they deny their service based on your timezone.

then you spend days wondering how they did it :( ,so after days of testings, finally using "safescript extension" I realized they do it by your time zone!

Brainiac

Posted 2013-09-21T22:43:00.423

Reputation: 571

1How can they locate you by timezone? in the most general form, thats 24 slices of the earth, thats huge. – Keltari – 2013-09-21T22:47:37.373

1-1 for the QA, +1 for @barlop . what the deuce? timezone on windows affecting surfing? they get it from your IP geolocation actually. try using a proxy from another country. – Lorenzo Von Matterhorn – 2013-09-21T23:04:48.277

sorry bros, my question seemed so stupid, I think I clarified my point now. – Brainiac – 2013-09-22T08:26:18.630

i've removed my downvote – barlop – 2013-09-22T17:48:49.440

I think the solution is to run your computer set to a different timezone (and with a different locale), based on whatever timezone you wish to spoof. (This, of course, in addition to somehow manipulating your IP address.) – Daniel R Hicks – 2013-09-23T01:14:38.503

we'll get there. here is an example webpage to fool sendspace.com/file/ytk8nd It would help i you go to the site that you spotted, and save the page locally and upload it to sendspace providing a link to download it. so we can test it without signing up. – barlop – 2013-09-23T10:42:28.963

Some other site I found that uses this trick is X10hosting.com , you can watch it performing easily: On main page type a domain, then goes to next page type a fake email and password, at this stage when you press the NEXT key it checks your locale and timezone. – Brainiac – 2013-09-23T19:10:38.863

Answers

I doubt that very much(that they do it by windows). Maybe they know the timezone at the location of your IP. Or some forums ask you for your timezone and you are telling them. Try changing the time in windows and see if they pick it up - they won't. And if you had multiple computers set to different time zones they won't know. You could hide your IP(so they only see another) but it'll be slow or it'll cost you.

barlop

Posted 2013-09-21T22:43:00.423

Reputation: 18 677

sorry for lack of details on my question, I edited the question, the problem isn't from IP. – Brainiac – 2013-09-22T08:07:33.483

It is quite easy to get your system's timezone, as set in the OS, through JavaScript on the browser. Type these in the location/url:

javascript:alert(new Date())   
javascript:alert(new Date().getTimezoneOffset())

The first shows the current time in your timezone, usually with a timezone offset and name, like "GMT-400 (EDT)". If that's too much parsing and math, the second shows minutes behind UTC. So if JavaScript is enabled, the site can get this value and stuff it in a field that gets submitted in a form, or simply send this info back to the server at any time.

So in addition to using a proxy to foil IP geolocation, you also need to disable JavaScript, which might break the site to some degree.

(And there are currently 40 timezones in use, not 24 -- some start at 30 and 45 minutes past the hour from UTC, and a few in the Pacific overlap by a day.)

EDIT: in addition to the timezone, you can also get your locale through the Date and Number objects: the order and separator for year, month, and day; and the thousands and decimal separators. Some combinations of these might, in a few cases, provide country-accurate location (or even slightly better -- it would be interesting to see a matrix of all the combinations).

Even if you could simply stub out Date and Number, that would probably break some useful functionality. So the best approach would be to modify the object prototypes so that they lie and use an arbitrarily chosen timezone and locale. That would require a fair amount of work on Date though; there are several related methods. For example, to force GMT:

Date.prototype.toString = Date.prototype.toGMTString;
Date.prototype.getTimezoneOffset = function() {return 0;};
// and about 10 more

As @barlop suggests, it looks like you can use Privoxy filters to modify the pages before they get to your browser. Due to (1) the way search and replace works with Privoxy, (2) the requirements of the patch, and (3) the flexible nature of HTML: you would have to apply the patch at the beginning of both the <head> and <body> (and even that is not 100% coverage).

Ken

Posted 2013-09-21T22:43:00.423

Reputation: 7 497

You are so much Right, you realized my problem without proper detail on my question.

So the question is how can we hide our timezone without completely disabling javascript !?

I think this gonna be a good Idea for a chrome extension :D. – Brainiac – 2013-09-22T08:04:25.670

1wow.. interesting. By the way regarding where you wrote "So in addition to using a proxy to foil IP geolocation, you also need to disable JavaScript, which might break the site to some degree" There is actually a program called Privoxy that can rewrite the html and javascript on a page. With it you can instruct it like s@a@b@g which would replace through the page, the letter a, with the letter b. I knew some java years ago but not javscript. Maybe one could do it by overiding the Date() object. Then any instance of Date that the program calls will be your fake one – barlop – 2013-09-22T18:01:51.437

that solution would require javascript knowledge and basic regex knowledge and basic privoxy knowledge. privoxy is a superuser question but requires the other two. You could perhaps ask on stackoverflow what regular expressions and what javscript, would fix an html page so it won't pick up the date. And if you ask, then link to it from here. as it's strongly related to this question. you could then get privoxy to do it, you could ask re privoxy on here. Last time I tried privoxy, it failed with HTTPS, but it might do HTTPS now. – barlop – 2013-09-22T18:12:42.070