Browser time zone and language info shared with sites

giani88

Hi,

I am using Mullvad and blocking all connections without a VPN, the VPN is always on. If I open an incognito instance of Vanadium to make a Proton account, when I go to provide a recovery email/phone number, Proton somehow already have my country's dialing code as the default. How is this possible? I am in a small country and there would be no reason to have it as the default without knowing my location.

How is this possible?

GrapheneOS

giani88 Websites receive your enabled languages which are separately configurable in the browser and time zone. In many cases, that's enough to accurately guess the country. Apps are given the cellular region country code, which isn't shared with websites by Chromium-based browsers, but a native app can detect the cellular region. GrapheneOS plans to add a feature for spoofing a different value within a profile but there are a bunch of APIs for this and it has to be complete.

giani88

Thanks for the thorough response. Just to explain a little more, the device is always in airplane mode, only used on WiFi and there was no use of any apps.

It was all within the Vanadium browser. Would the time zone being configured to the country alone be sufficient for this to happen? The local language isn't enabled on the device.

The follow up I have to this is, could this be used maliciously to identify the location of a user?

GrapheneOS

giani88 Browsers normally send the configured time zone to each website. We plan to add a site setting to Vanadium for always sending UTC as the time zone, which we could enable by default and users could disable it for sites they want to know the time zone. The time zone sent by the browser is generic and refers to a time zone rather than a specific location in it.

The follow up I have to this is, could this be used maliciously to identify the location of a user?

We've explained browsers give the time zone to sites. Time zones are a general region. Not clear what you're asking.

r_dac

I have learned that it's possible for an app to determine the phone's location (at least to the granularity level of country) based on the current cellular network connected to the phone, even if there is no phone number associated with the SIM ( silent.link eSIM in my case). It can do this even if the app has no network permission granted, and/or if an always VPN is activated.

The app I discovered this with is My Expenses (found on F-droid).

After installation, it walks through examples and setup options which include currency options.

If the all SIM cards are selected off (or airplane mode is on), then the app with no network permissions refers to regional language settings to grab a default currency option.

However, as soon as a SIM is turned on / airplane mode disabled, then the app instantly recognizes which country it is in.

So it appears that an application can pull not only a country code from a number, but it can also pull the network provider to determine which country the device is currently in. It can do this even if it has no network permissions.

Is this expected behaviour?
Thanks

de0u

r_dac So it appears that an application can pull not only a country code from a number, but it can also pull the network provider to determine which country the device is currently in. It can do this even if it has no network permissions.

Is this expected behaviour?

https://grapheneos.org/faq#non-hardware-identifiers

Titan_M2

GrapheneOS Browsers normally send the configured time zone to each website.

It’s available via JavaScript but it’s not sent on every request like the User-Agent.

GrapheneOS

@r_dac We've previously explained in this thread cellular region country code. We're not referring to the prefix code of a phone number. Apps can't access the phone number without the Phone permission. You're making incorrect assumptions.

r_dac

GrapheneOS
Thank you for explaining the difference.

The prospect of a future feature to mask or spoof this which you mentioned above sounds useful. I imagine this is a data point that some apps might report in telemetry connections?

r_dac

Follow up question. Is this cellular region country code data accessable to apps through the "View Network Connections" permission, or its just inherently available to all apps at all times?

Thanks

r_dac

I answered my own question - found this discussion where an Android user reports that despite using a VPN, apps are showing region specific content, which is likely based on the availability of network country information to any application that calls for it.

https://android.stackexchange.com/questions/247679/how-do-android-apps-access-phones-simcard-and-determine-the-location-country-wi

A future ability for GOS to mask or spoof this data would certainly be a worthwhile privacy feature which I believe would further enhance the exisiting and fantastic privacy-based location features GOS has introduced already.

The ability for an app to determine the true country of origin of a user, despite the use of tor or vpn is what I would consider a significant privacy gap... if the goal is to obscure your current location to bypass regional blocks, this ability to call up network country codes seems to allow apps to cut right through that, and the only available mitigation is to turn off the sim slots.