Glossary

Timezone and geolocation spoofing

Making a browser report a clock — and sometimes a position — that matches where the session claims to be rather than where the machine is.

Also called: timezone spoofing, geolocation spoofing.

A page can read the browser's timezone without asking anyone: the internationalisation API reports the zone by name, and a date object reports the offset from UTC. Position is different — the geolocation API is permission-gated, so a site has to prompt and you can decline, which most sessions do. The two get lumped together because they answer the same question, but they are not the same kind of signal at all.

Operationally the timezone is the one that matters, because it is read silently and because a mismatch is decisive: a profile presenting a Warsaw device while arriving from an address that resolves to Brazil has contradicted itself before the page finished loading. Argus sets the timezone per profile in the renderer, generated as part of the same coherent set as the platform, languages, screen and CPU count, so it agrees with the proxy the profile is assigned. Argus does not spoof the geolocation API — that prompt is answered by declining it — and it does not synthesize motion or orientation sensor input either, because that cannot be done convincingly: an event created from script is marked as untrusted in a way a page can read and a script cannot change. The fingerprints page covers what is applied and where.