[tbb-bugs] #17046 [Tor Browser]: Event.timeStamp reveals startup time

[Tor Bug Tracker & Wiki]

#17046: Event.timeStamp reveals startup time
-----------------------------+--------------------------
 Reporter:  arthuredelstein  |          Owner:  tbb-team
     Type:  defect           |         Status:  new
 Priority:  normal           |      Milestone:
Component:  Tor Browser      |        Version:
 Keywords:  tbb-linkability  |  Actual Points:
Parent ID:                   |         Points:
-----------------------------+--------------------------
 Experimenting with JS Events, I noticed the following:

 If I open a web page's console in standard Firefox and enter
 `new Event("asdf").timeStamp`
 it returns a number like
 `1442000361118206`.

 This corresponds to the number of microseconds since the epoch. I confimed
 this result by entering:
 {{{
 window.setInterval(() => console.log(new Event("asdf").timeStamp), 1000)
 }}}
 and it prints out
 {{{
 1442000426991504
 1442000427990600
 1442000428989561
 1442000429989980
 1442000430990465
 1442000431990790
 1442000432989823
 1442000433989783
 ...
 }}}
 This violates the web standard, which specifies ''milliseconds'' since the
 epoch: http://www.w3.org/TR/2000/REC-DOM-
 Level-2-Events-20001113/events.html#Events-Event-timeStamp

 Tor Browser gives similar result, but rounded to the nearest 100
 microseconds, because of TBB's #1517 patch.

 In any case, that's not the usual way to use Events. A more typical usage
 is:

 `window.addEventListener("mousedown", e => console.log(e.timeStamp))`

 If I click the mouse once per second (by listening to a clock) I get:
 {{{
 1028609
 1029641
 1030609
 1031641
 1032617
 1033609
 1034601
 1035601
 ...
 }}}

 which indicates that the results are expressed in milliseconds. The epoch,
 however, is defined differently. In this case it reveals the system
 startup time, which is a linkability issue.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17046>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online