Using the User-Agent in combination with the Accept-Language header is probably enough to finger-print specific users that have their traffic exiting a VPN. As

Using the User-Agent in combination with the Accept-Language header is probably enough to finger-print specific users that have their traffic exiting a VPN. Assuming the NSA are monitoring the traffic exiting VPN exit points, one minor identity leak by a user (i.e. accessing a website that leaks their identity such as their Facebook profile) would allow the NSA to back-track against any stored traffic using those exact headers. e.g. NSA db search: -- Search for 'Junto' traffic exiting VyprVPN London SELECT [Url],[Timestamp],[Headers],[Ip],[Body],[Response] FROM HttpTrafficLog WHERE UserAgent = 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36' AND AcceptLanguage = 'en-GB,en;q=0.8,de-DE;q=0.6,de;q=0.4, zh-CN;q=0.2,zh;q=0.2,en-US;q=0.2' The user agent leaks far too much in my opinion, and no, I do not have British-German-Chinese heritage.