10 ms·

Show HN: Browser extension that spoofs your location data to match your VPN

313 points by _gyhb 4y ago

_gyhb 4y ago
Recently made this extension and interested in getting some feedback on it. Vytal can Spoof your timezone, locale, geolocation and user agent. This data can be used to track you or reveal your location. Most extensions that provide anti-fingerprinting features rely on content scripts to inject script tags into webpages. There are many limitations to script tag injections which you can read about here: https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/ https://palant.info/2020/12/10/how-anti-fingerprinting-exten... Vytal utilizes the chrome.debugger API to spoof this data. This allows the data to be spoofed in frames, web workers and during the initial loading of a website. It also makes the spoofing completely undetectable. You can test and compare Vytal and other extensions on https://vytal.io https://vytal.io Unfortunately it doesn't work on Firefox since Firefox doesn't support the debugger API. Works on Brave tho.
- InCityDreams 4y ago
  Using Brave browser. Every page, and every reload brings up a "'Vytal' started debugging this browser" message.
- 0x0000000 4y ago
  I'm commenting here both to remind myself to check back and try this out when I'm not on mobile, and to thank you for building this- at first glance it looks good.
  - kilroy123 4y ago
    You can save a comment. Just click the timestamp (x hours ago), then click favorite.
- 0des 4y ago
  I dont want to dislike firefox, but I am starting to find new reasons to resent it. It seems like every other week there is something new I'm finding out about that gives me pause before running updates. Every new 'feature' brings me further and further away from feeling like it's a browser I can trust to be just a browser. Something has to change. Pocket, Allo, still taking the google allowance, absolutely squandering their endowments on salary, too much focus on social signaling and politics. Just be a browser, please. I won't be going to anything chrome-like, but I do see myself spending a lot more time using and sponsoring qutebrowser, or simply passively consuming offline.
  - judge2020 4y ago
    > still taking the google allowance, Doesn't Mozilla's revenue breakdown still show Google as the majority of their revenue, and pocket et al are efforts to diversify?
    - xalava 4y ago
      I wonder how that compares with Google Chrome relationship with Google...
  - deleted 4y ago
    [deleted]
  - jamal-kumar 4y ago
    Not having some proprietary debugger thing for this to work with when you can just set location in about:config seems like the pettiest nitpick
    - 0des 4y ago
      If wanting a browser to be just a browser is petty, then I am the pettiest. If you havent tried qutebrowser yet, give it a shot. When I say just a browser, this hits it pretty close, if you ask me.
      - jamal-kumar 4y ago
        Vim mode is pretty neat. It seems like the whole app is kind of just like a python gui app wrapper around webkit? Looks like it would be pretty good if I was using linux and a tiling wm as my main thing but these days I'm pretty bound to Windows for the type of development I'm working on. Most of my linux desktop usage these days is stuff like writing scrapers in cloud containers that need a real browser that I can control using selenium or puppeteer or whatever though, is it supporting anything like that? If this works on Windows too that would be a bonus.
        0des 4y ago
- tauwauwau 4y ago
  Just installed it, it's showing a message on top of each tab in Chrome "Vytal" started debugging this browser Is there a way to get rid of it?
  - ldoughty 4y ago
    There is a note at the link that explains the command line flag you need to pass in
    - tauwauwau 4y ago
      Thanks, I will have to create a shortcut for it. This should work chrome.exe --silent-debugger-extension-api Is it safe to do? I mean I want to stop this message for Vytal only, because I know that it uses debugger API. But I would want to know if tomorrow my adblocker starts to use debugger API.
      - ibejoeb 4y ago
        Any existing extension would have to explicitly declare the appropriate permission for using the debugger API. Chrome automatically disables extensions that add new permissions until you review them.
- WithinReason 4y ago
  Can you explain how Firefox (or Chrome) knows my location within 20m even if I use a VPN? Brave puts me where I think the VPN exit point is. For example: https://wikishootme.toolforge.org/ https://wikishootme.toolforge.org/
  - saurik 4y ago
    Many (most?) VPN mechanisms don't entirely remove access to the other routes from apps that manually request them, so even if an app isn't able to use something akin to "location services" on your device it might still easily be able to get access to your other IP addresses by sending requests with sockets manually bound to specific interfaces, and even might choose to lower the priority of information learned using interfaces that are clearly tunnel devices instead of network cards.
    - TecoAndJix 4y ago
      Also known as split tunnel, this can be used by corporate VPN solutions to lower the amount of network traffic entering a data center (so you don’t overload your undersized pipes)
      - saurik 4y ago
        No, I don't mean that. That's when you purposefully set your routing table to split some traffic to different paths. The premise here is that even if all of your traffic is supposedly going over a VPN, an app can often opt out of that and do whatever it wants.
    - TedDoesntTalk 4y ago
      > by sending requests with sockets manually bound to specific interfaces I don’t believe this is possible in client JavaScript within a web browser. Very open to be proved wrong.
      - saurik 4y ago
        I thought the complaint was that the browser was figuring it out directly and then exposing it, such as via the browser's location API, not that the website was figuring it out using non-location network mechanisms provided by the browser. (FWIW, a website that is given media recording privileges can definitely do that, though, using WebRTC. If you don't have that privilege then you can still use the WebRTC API but it doesn't return alternative candidates. But I also don't think that is what they meant.)
- momirlan 4y ago
  if this were true then BBC would know I'm not watching from UK.
- VWWHFSfQ 4y ago
  > It also makes the spoofing completely undetectable. It's my understanding that the usage of the debugger is detectable by scripts running on the page. I've actually come across content websites that will refuse to activate their features (play video) if the debugger is active. Similarly on Android some video streaming apps will refuse to load and play their content catalog if USB debugging is enabled.
  - _gyhb 4y ago
    How can you detect it? Which websites refuse to activate their features if the debugger is active?
    - hericium 4y ago
      I've had the opposite experience: parts of websites broken by tracking blocker started working after popping debugger up.
    - runlevel1 4y ago
      The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.
      - _gyhb 4y ago
        I'm unsure if that would work for this extension. Do you have a link to an implementation?
        runlevel1 4y ago
        I'm not familiar with what happens when `debugger` is eval'd while attached using the debugger API. If it ignores it, you're fine. This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf https://www.usenix.org/system/files/sec21-musch.pdf The debugger timing method is described on page 10.
rgbrenner 4y ago
If you use Firefox, you can set your location in about:config without an extension: https://security.stackexchange.com/questions/147166/how-can-you-fake-geolocation-in-firefox https://security.stackexchange.com/questions/147166/how-can-...
lilsoso 4y ago
Very interesting. Is there a risk that installing Chrome plugins makes your browser fingerprint more unique? Isn't the list of installed plugin-ins checked?
- _gyhb 4y ago
  Chrome extensions can be detected by fetching their web-accessible resources. These are files inside an extension that can be accessed by web pages. Vytal has no web-accessible resources so it can not be detected.
  - gildas 4y ago
    With Manifest V3, you an inject scripts in the "MAIN" world [1] without exposing them as web-accessible resources. [1] https://developer.chrome.com/docs/extensions/reference/scripting/#type-ExecutionWorld https://developer.chrome.com/docs/extensions/reference/scrip...
walrus01 4y ago
In addition to this I can recommend user-agent switcher: https://addons.mozilla.org/en-CA/firefox/addon/user-agent-switcher-revived/ https://addons.mozilla.org/en-CA/firefox/addon/user-agent-sw...
- deleted 4y ago
  [deleted]
stevewatson301 4y ago
This extension takes an interesting approach to spoofing data, which is nice! In my case, I’m interested in doing the same thing inside of Puppeteer for web scraping, unfortunately it seems like the only possible approach is similar to content scripts (for example https://github.com/berstend/puppeteer-extra/tree/master/packages/puppeteer-extra-plugin-stealth https://github.com/berstend/puppeteer-extra/tree/master/pack...) which leads to it being easily detected. Are there any similar approaches that can be used for Puppeteer?
- frankenstein 4y ago
  You can load extensions in puppeteer, also in headless with the experimental chrome mode. https://github.com/puppeteer/puppeteer/blob/main/docs/api.md#working-with-chrome-extensions https://github.com/puppeteer/puppeteer/blob/main/docs/api.md...
  - easrng 4y ago
    The flags you need for headless extensions are --enable-features=UseOzonePlatform and --ozone-platform=headless, but tell puppeteer to run normally, not headless. That way it still uses full chrome but doesn't require a display server.
deleted 4y ago
[deleted]
orliesaurus 4y ago
I didn't know how extensive and interesting the chrome debugging API was until today[1]..thanks for sharing! [1] https://developer.chrome.com/docs/extensions/mv3/messaging/ https://developer.chrome.com/docs/extensions/mv3/messaging/
kdot 4y ago
Does geolocation need to be spoofed if I'm on a VPN? Is't geolocation detected using IP address?
- Shugarl 4y ago
  Well Google Map still knows where I am when my VPN is activated. So I'd say yes, unless VPNs on mobile are less reliable than on PC
  - aaronmdjones 4y ago
    Google Maps still knows where you are on your mobile because it can still detect nearby WiFi networks and use the GNSS receiver. You would need to remove these permissions, and then it wouldn't work at all.
- dotancohen 4y ago
  Modern browsers provide a location API, independent of one's IP address.
sakerbos 4y ago
Nice one! It's a pity about the tab initialisation problem, I almost always open links in new tabs but great work nonetheless.
alam2000 4y ago
Does it spoof IP location?
- yosito 4y ago
  That's what you need a VPN for
  - TedDoesntTalk 4y ago
    Or a proxy server.
yosito 4y ago
I'm going to have to try using this to activate bank cards and add them to Google Pay while abroad. That's my one use case that VPNs have proven not to be enough for.
traceroute66 4y ago
Surely this is a case of inventing something that does not to be invented ? Surely the only correct answer is: 1) Go to browser preferences 2) Go to Privacy & Security 3) "Don't allow sites to see your location" = ON Firefox has this. Brave has this. And if you use Chrome, well, sharing your location is probably the least of your worries !
- _gyhb 4y ago
  Surely this is a case of commenting something that does not to be commented ? Check out https://vytal.io/ https://vytal.io/. There are many more data points then just the geolocation api.
  - traceroute66 4y ago
    > Check out https://vytal.io/ https://vytal.io/. There are many more data points then just the geolocation api. I think most people would agree that your so called additional data points are worthless for the purpose that most people would be concerned about location data. Something like timezone "location" (which basically what your vytal website is showing) is simply not granular enough to be used for nefarious purposes. I mean, if my browser is telling someone that my "location" is EDT timezone what good is that going to do them ? Its still too much of haystack to be useful to anyone. Let's be honest here, "location" to most people means GPS-type location (i.e. you'll find me in this house on this street). Anything more coarse than that is frankly of limited use to an adversary.
    - _gyhb 4y ago
      What if you're trying to hide your country lol? It also spoofs your locale and user agent. Just because its not something you care about doesn't mean its useless. Also never claimed it was going to change the world or anything. Just thought it was an interesting way to use the debugger api and that some people might find it cool.
    - TechBro8615 4y ago
      Consider some “people who downloaded and executed ga.js from misinfo.gov.” What is the relative size of these three anonymity sets? * browser with IP in USA but timezone in Russia * browser with IP in USA and timezone in USA * browser with IP in Russia with timezone in Russia Hint: it’s the middle one. The smaller the anonymity set, the more conspicuous and therefore fingerprintable you are.
tamrix 4y ago
You've also got to set you locale aswell. It's easy to see if you've set your language to say Australian English.
- withinboredom 4y ago
  I have my browser set to English in a non-English country. Set your locale to what you are comfortable with reading. It doesn’t (shouldn’t) factor into things except the language the website displays. Unless you are Google, then it might just randomly pick a random language (my results flip flop between Portuguese and Dutch, despite manually changing the language back to English repeatedly).
- overspeed 4y ago
  What if I am travelling to another country physically where I don't read or write the local language? Would this affect my website access even if I'm connected via an IP inside the country?
curben 4y ago
I'm using these FF addons CanvasBlocker and Spoof Timezone to spoof UA and timezone. I checked vytal.io and it shows those addons can't fully spoof web worker method. I usually use https://browserleaks.com/javascript https://browserleaks.com/javascript to test spoofing addons.
ryan-c 4y ago
The fact that the debugger API is active is almost certainly detectable. I haven't tried recently, but it's been possible in older versions - and I've yet to come across a spoofing tool that I couldn't find a way to detect.
- _gyhb 4y ago
  How can you detect it?
beatthatflight 4y ago
So I've installed it. I'm tunneling to another country. Vytal says everything is correct for country B. However the site I'm testing posting to still detects that I'm outside their country. And I can't work out how :/
- BlueGh0st 4y ago
  Perhaps try a DNS leak test?
  - beatthatflight 4y ago
    I use google DNS - surely that's mostly agnostic? I think I've worked out how tho. They detect VPN/proxies, where there are plenty of libraries to do so. So I tried creating a VPS in the same city as them last night, used freakin' lynx on a terminal so sans-Javascript, and lo and behold, still detected that I wasn't in their country :/
    - account42 4y ago
      > I use google DNS - surely that's mostly agnostic? https://developers.google.com/speed/public-dns/docs/ecs https://developers.google.com/speed/public-dns/docs/ecs
- thrdbndndn 4y ago
  Very few websites/services actually use location to test geo-restriction (especially on browser. it's more common for mobile apps). The most common reason why you VPN didn't work is that they simply block IP ranges of common used (proxy) servers. They also can check if the IP is "Native IP" (means it's actually registered in the country that the server is in.)
  - beatthatflight 4y ago
    I think I've worked it out. They detect VPN/proxies, where there are plenty of libraries to do so. So I tried creating a VPS in the same city as them last night, used freakin' lynx on a terminal so sans-Javascript, and lo and behold, still detected that I wasn't in their country :/
puffpuffisbuff 4y ago
Wow, this is the first solution to getting around Bumble's geo-locking that I've seen since 2021. And it's simple too. Great job!
deknos 4y ago
out of the interest... are there any firefox derivations with which still the classic addons work?
kkfx 4y ago
Modern VPN usage means do not have understood the purpose of a VPN... Using a VPN as a proxy to circumvent geographical block is reasonable to a certain extent, but call them a privacy help, when you do not own the server is ridiculous...
- hedora 4y ago
  VPNs help with privacy when the alternative is known to be malicious, as most US ISP connections are.
  - kkfx 4y ago
    So... An unknown commercial VPN hoster who happen to sell so called now "VPNs", with a siege in British Virgin Island (for instance) is not malicious while a local ISP, obliged to follow national laws you probably know is worse? It's hard to believe for me... If I host my VPN for instance to include some remote machines to my LAN, or as a company to offer a LAN to nomadic clients, that's a thing. If I decide to route 100% of my traffic to some servers in exotic locations where no privacy laws exists, where I probably never ever look for a local lawyer just because of lack of norms, language and costs issues, it's IMVHO a crazy choice like those who regularly buy "anti-5G radiation-absorber stickers" or "air purifier" and things like that. My ISP might spy on me, surely they do, but we have a contract under local laws we both knows, we speak the same language, I have a local lawyer I trust etc. Using something else to circumvent eventual geo-blocks ok, but for the rest? How can I trust more an unknown third from exotic places telling in its advertisement "we care about privacy"?
i13e 4y ago
The idea for this extension is really cool! However I use a proxy switcher extension to connect to my vpn client on a per website basis (tldr split tunneling). Is there any way to make your extension work with this setup?
jacooper 4y ago
Great project! However is there any features over just going to developer tools > Sensors > Location and overriding it manually? Is it just to be able to match your IP automatically ? I'm currently using it on brave, and there is always an info bar that pops up("Vytal" started debugging this browser session) Is there a way to permanently dismiss this?, because it pops up with every refresh and its very annoying.

313 points by _gyhb 4y ago

Recently made this extension and interested in getting some feedback on it. Vytal can Spoof your timezone, locale, geolocation and user agent. This data can be used to track you or reveal your location. Most extensions that provide anti-fingerprinting features rely on content scripts to inject script tags into webpages. There are many limitations to script tag injections which you can read about here: https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/ https://palant.info/2020/12/10/how-anti-fingerprinting-exten... Vytal utilizes the chrome.debugger API to spoof this data. This allows the data to be spoofed in frames, web workers and during the initial loading of a website. It also makes the spoofing completely undetectable. You can test and compare Vytal and other extensions on https://vytal.io https://vytal.io Unfortunately it doesn't work on Firefox since Firefox doesn't support the debugger API. Works on Brave tho.

InCityDreams 4y ago
Using Brave browser. Every page, and every reload brings up a "'Vytal' started debugging this browser" message.
0x0000000 4y ago
I'm commenting here both to remind myself to check back and try this out when I'm not on mobile, and to thank you for building this- at first glance it looks good.
- kilroy123 4y ago
  You can save a comment. Just click the timestamp (x hours ago), then click favorite.
0des 4y ago
I dont want to dislike firefox, but I am starting to find new reasons to resent it. It seems like every other week there is something new I'm finding out about that gives me pause before running updates. Every new 'feature' brings me further and further away from feeling like it's a browser I can trust to be just a browser. Something has to change. Pocket, Allo, still taking the google allowance, absolutely squandering their endowments on salary, too much focus on social signaling and politics. Just be a browser, please. I won't be going to anything chrome-like, but I do see myself spending a lot more time using and sponsoring qutebrowser, or simply passively consuming offline.
- judge2020 4y ago
  > still taking the google allowance, Doesn't Mozilla's revenue breakdown still show Google as the majority of their revenue, and pocket et al are efforts to diversify?
  - xalava 4y ago
    I wonder how that compares with Google Chrome relationship with Google...
- deleted 4y ago
  [deleted]
- jamal-kumar 4y ago
  Not having some proprietary debugger thing for this to work with when you can just set location in about:config seems like the pettiest nitpick
  - 0des 4y ago
    If wanting a browser to be just a browser is petty, then I am the pettiest. If you havent tried qutebrowser yet, give it a shot. When I say just a browser, this hits it pretty close, if you ask me.
    - jamal-kumar 4y ago
      Vim mode is pretty neat. It seems like the whole app is kind of just like a python gui app wrapper around webkit? Looks like it would be pretty good if I was using linux and a tiling wm as my main thing but these days I'm pretty bound to Windows for the type of development I'm working on. Most of my linux desktop usage these days is stuff like writing scrapers in cloud containers that need a real browser that I can control using selenium or puppeteer or whatever though, is it supporting anything like that? If this works on Windows too that would be a bonus.
      - 0des 4y ago
tauwauwau 4y ago
Just installed it, it's showing a message on top of each tab in Chrome "Vytal" started debugging this browser Is there a way to get rid of it?
- ldoughty 4y ago
  There is a note at the link that explains the command line flag you need to pass in
  - tauwauwau 4y ago
    Thanks, I will have to create a shortcut for it. This should work chrome.exe --silent-debugger-extension-api Is it safe to do? I mean I want to stop this message for Vytal only, because I know that it uses debugger API. But I would want to know if tomorrow my adblocker starts to use debugger API.
    - ibejoeb 4y ago
      Any existing extension would have to explicitly declare the appropriate permission for using the debugger API. Chrome automatically disables extensions that add new permissions until you review them.
WithinReason 4y ago
Can you explain how Firefox (or Chrome) knows my location within 20m even if I use a VPN? Brave puts me where I think the VPN exit point is. For example: https://wikishootme.toolforge.org/ https://wikishootme.toolforge.org/
- saurik 4y ago
  Many (most?) VPN mechanisms don't entirely remove access to the other routes from apps that manually request them, so even if an app isn't able to use something akin to "location services" on your device it might still easily be able to get access to your other IP addresses by sending requests with sockets manually bound to specific interfaces, and even might choose to lower the priority of information learned using interfaces that are clearly tunnel devices instead of network cards.
  - TecoAndJix 4y ago
    Also known as split tunnel, this can be used by corporate VPN solutions to lower the amount of network traffic entering a data center (so you don’t overload your undersized pipes)
    - saurik 4y ago
      No, I don't mean that. That's when you purposefully set your routing table to split some traffic to different paths. The premise here is that even if all of your traffic is supposedly going over a VPN, an app can often opt out of that and do whatever it wants.
  - TedDoesntTalk 4y ago
    > by sending requests with sockets manually bound to specific interfaces I don’t believe this is possible in client JavaScript within a web browser. Very open to be proved wrong.
    - saurik 4y ago
      I thought the complaint was that the browser was figuring it out directly and then exposing it, such as via the browser's location API, not that the website was figuring it out using non-location network mechanisms provided by the browser. (FWIW, a website that is given media recording privileges can definitely do that, though, using WebRTC. If you don't have that privilege then you can still use the WebRTC API but it doesn't return alternative candidates. But I also don't think that is what they meant.)
momirlan 4y ago
if this were true then BBC would know I'm not watching from UK.
VWWHFSfQ 4y ago
> It also makes the spoofing completely undetectable. It's my understanding that the usage of the debugger is detectable by scripts running on the page. I've actually come across content websites that will refuse to activate their features (play video) if the debugger is active. Similarly on Android some video streaming apps will refuse to load and play their content catalog if USB debugging is enabled.
- _gyhb 4y ago
  How can you detect it? Which websites refuse to activate their features if the debugger is active?
  - hericium 4y ago
    I've had the opposite experience: parts of websites broken by tracking blocker started working after popping debugger up.
  - runlevel1 4y ago
    The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.
    - _gyhb 4y ago
      I'm unsure if that would work for this extension. Do you have a link to an implementation?
      - runlevel1 4y ago
        I'm not familiar with what happens when `debugger` is eval'd while attached using the debugger API. If it ignores it, you're fine. This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf https://www.usenix.org/system/files/sec21-musch.pdf The debugger timing method is described on page 10.

rgbrenner 4y ago

If you use Firefox, you can set your location in about:config without an extension: https://security.stackexchange.com/questions/147166/how-can-you-fake-geolocation-in-firefox https://security.stackexchange.com/questions/147166/how-can-...

lilsoso 4y ago

Very interesting. Is there a risk that installing Chrome plugins makes your browser fingerprint more unique? Isn't the list of installed plugin-ins checked?

_gyhb 4y ago
Chrome extensions can be detected by fetching their web-accessible resources. These are files inside an extension that can be accessed by web pages. Vytal has no web-accessible resources so it can not be detected.
- gildas 4y ago
  With Manifest V3, you an inject scripts in the "MAIN" world [1] without exposing them as web-accessible resources. [1] https://developer.chrome.com/docs/extensions/reference/scripting/#type-ExecutionWorld https://developer.chrome.com/docs/extensions/reference/scrip...

walrus01 4y ago

In addition to this I can recommend user-agent switcher: https://addons.mozilla.org/en-CA/firefox/addon/user-agent-switcher-revived/ https://addons.mozilla.org/en-CA/firefox/addon/user-agent-sw...

deleted 4y ago
[deleted]

stevewatson301 4y ago

This extension takes an interesting approach to spoofing data, which is nice! In my case, I’m interested in doing the same thing inside of Puppeteer for web scraping, unfortunately it seems like the only possible approach is similar to content scripts (for example https://github.com/berstend/puppeteer-extra/tree/master/packages/puppeteer-extra-plugin-stealth https://github.com/berstend/puppeteer-extra/tree/master/pack...) which leads to it being easily detected. Are there any similar approaches that can be used for Puppeteer?

frankenstein 4y ago
You can load extensions in puppeteer, also in headless with the experimental chrome mode. https://github.com/puppeteer/puppeteer/blob/main/docs/api.md#working-with-chrome-extensions https://github.com/puppeteer/puppeteer/blob/main/docs/api.md...
- easrng 4y ago
  The flags you need for headless extensions are --enable-features=UseOzonePlatform and --ozone-platform=headless, but tell puppeteer to run normally, not headless. That way it still uses full chrome but doesn't require a display server.

deleted 4y ago

[deleted]

orliesaurus 4y ago

I didn't know how extensive and interesting the chrome debugging API was until today[1]..thanks for sharing! [1] https://developer.chrome.com/docs/extensions/mv3/messaging/ https://developer.chrome.com/docs/extensions/mv3/messaging/

kdot 4y ago

Does geolocation need to be spoofed if I'm on a VPN? Is't geolocation detected using IP address?

Shugarl 4y ago
Well Google Map still knows where I am when my VPN is activated. So I'd say yes, unless VPNs on mobile are less reliable than on PC
- aaronmdjones 4y ago
  Google Maps still knows where you are on your mobile because it can still detect nearby WiFi networks and use the GNSS receiver. You would need to remove these permissions, and then it wouldn't work at all.
dotancohen 4y ago
Modern browsers provide a location API, independent of one's IP address.

sakerbos 4y ago

Nice one! It's a pity about the tab initialisation problem, I almost always open links in new tabs but great work nonetheless.

alam2000 4y ago

Does it spoof IP location?

yosito 4y ago
That's what you need a VPN for
- TedDoesntTalk 4y ago
  Or a proxy server.

yosito 4y ago

I'm going to have to try using this to activate bank cards and add them to Google Pay while abroad. That's my one use case that VPNs have proven not to be enough for.

traceroute66 4y ago

Surely this is a case of inventing something that does not to be invented ? Surely the only correct answer is: 1) Go to browser preferences 2) Go to Privacy & Security 3) "Don't allow sites to see your location" = ON Firefox has this. Brave has this. And if you use Chrome, well, sharing your location is probably the least of your worries !

_gyhb 4y ago
Surely this is a case of commenting something that does not to be commented ? Check out https://vytal.io/ https://vytal.io/. There are many more data points then just the geolocation api.
- traceroute66 4y ago
  > Check out https://vytal.io/ https://vytal.io/. There are many more data points then just the geolocation api. I think most people would agree that your so called additional data points are worthless for the purpose that most people would be concerned about location data. Something like timezone "location" (which basically what your vytal website is showing) is simply not granular enough to be used for nefarious purposes. I mean, if my browser is telling someone that my "location" is EDT timezone what good is that going to do them ? Its still too much of haystack to be useful to anyone. Let's be honest here, "location" to most people means GPS-type location (i.e. you'll find me in this house on this street). Anything more coarse than that is frankly of limited use to an adversary.
  - _gyhb 4y ago
    What if you're trying to hide your country lol? It also spoofs your locale and user agent. Just because its not something you care about doesn't mean its useless. Also never claimed it was going to change the world or anything. Just thought it was an interesting way to use the debugger api and that some people might find it cool.
  - TechBro8615 4y ago
    Consider some “people who downloaded and executed ga.js from misinfo.gov.” What is the relative size of these three anonymity sets? * browser with IP in USA but timezone in Russia * browser with IP in USA and timezone in USA * browser with IP in Russia with timezone in Russia Hint: it’s the middle one. The smaller the anonymity set, the more conspicuous and therefore fingerprintable you are.

tamrix 4y ago

You've also got to set you locale aswell. It's easy to see if you've set your language to say Australian English.

withinboredom 4y ago
I have my browser set to English in a non-English country. Set your locale to what you are comfortable with reading. It doesn’t (shouldn’t) factor into things except the language the website displays. Unless you are Google, then it might just randomly pick a random language (my results flip flop between Portuguese and Dutch, despite manually changing the language back to English repeatedly).
overspeed 4y ago
What if I am travelling to another country physically where I don't read or write the local language? Would this affect my website access even if I'm connected via an IP inside the country?

curben 4y ago

I'm using these FF addons CanvasBlocker and Spoof Timezone to spoof UA and timezone. I checked vytal.io and it shows those addons can't fully spoof web worker method. I usually use https://browserleaks.com/javascript https://browserleaks.com/javascript to test spoofing addons.

ryan-c 4y ago

The fact that the debugger API is active is almost certainly detectable. I haven't tried recently, but it's been possible in older versions - and I've yet to come across a spoofing tool that I couldn't find a way to detect.

_gyhb 4y ago
How can you detect it?

beatthatflight 4y ago

So I've installed it. I'm tunneling to another country. Vytal says everything is correct for country B. However the site I'm testing posting to still detects that I'm outside their country. And I can't work out how :/

BlueGh0st 4y ago
Perhaps try a DNS leak test?
- beatthatflight 4y ago
  I use google DNS - surely that's mostly agnostic? I think I've worked out how tho. They detect VPN/proxies, where there are plenty of libraries to do so. So I tried creating a VPS in the same city as them last night, used freakin' lynx on a terminal so sans-Javascript, and lo and behold, still detected that I wasn't in their country :/
  - account42 4y ago
    > I use google DNS - surely that's mostly agnostic? https://developers.google.com/speed/public-dns/docs/ecs https://developers.google.com/speed/public-dns/docs/ecs
thrdbndndn 4y ago
Very few websites/services actually use location to test geo-restriction (especially on browser. it's more common for mobile apps). The most common reason why you VPN didn't work is that they simply block IP ranges of common used (proxy) servers. They also can check if the IP is "Native IP" (means it's actually registered in the country that the server is in.)
- beatthatflight 4y ago
  I think I've worked it out. They detect VPN/proxies, where there are plenty of libraries to do so. So I tried creating a VPS in the same city as them last night, used freakin' lynx on a terminal so sans-Javascript, and lo and behold, still detected that I wasn't in their country :/

puffpuffisbuff 4y ago

Wow, this is the first solution to getting around Bumble's geo-locking that I've seen since 2021. And it's simple too. Great job!

deknos 4y ago

out of the interest... are there any firefox derivations with which still the classic addons work?

kkfx 4y ago

Modern VPN usage means do not have understood the purpose of a VPN... Using a VPN as a proxy to circumvent geographical block is reasonable to a certain extent, but call them a privacy help, when you do not own the server is ridiculous...

hedora 4y ago
VPNs help with privacy when the alternative is known to be malicious, as most US ISP connections are.
- kkfx 4y ago
  So... An unknown commercial VPN hoster who happen to sell so called now "VPNs", with a siege in British Virgin Island (for instance) is not malicious while a local ISP, obliged to follow national laws you probably know is worse? It's hard to believe for me... If I host my VPN for instance to include some remote machines to my LAN, or as a company to offer a LAN to nomadic clients, that's a thing. If I decide to route 100% of my traffic to some servers in exotic locations where no privacy laws exists, where I probably never ever look for a local lawyer just because of lack of norms, language and costs issues, it's IMVHO a crazy choice like those who regularly buy "anti-5G radiation-absorber stickers" or "air purifier" and things like that. My ISP might spy on me, surely they do, but we have a contract under local laws we both knows, we speak the same language, I have a local lawyer I trust etc. Using something else to circumvent eventual geo-blocks ok, but for the rest? How can I trust more an unknown third from exotic places telling in its advertisement "we care about privacy"?

i13e 4y ago

The idea for this extension is really cool! However I use a proxy switcher extension to connect to my vpn client on a per website basis (tldr split tunneling). Is there any way to make your extension work with this setup?

jacooper 4y ago

Great project! However is there any features over just going to developer tools > Sensors > Location and overriding it manually? Is it just to be able to match your IP automatically ? I'm currently using it on brave, and there is always an info bar that pops up("Vytal" started debugging this browser session) Is there a way to permanently dismiss this?, because it pops up with every refresh and its very annoying.