Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How does Google Maps determine my location?

I've gotten some understanding of Google Maps' geolocation methods from here: http://friendlybit.com/js/geolocation-and-google-maps/

In the newer browsers (all but IE6, IE7, or IE8) may ask you for your positioning information from the browser. It usually shows up as a bar at the top of the browser. The browser then gathers two specific forms of positioning information from your computer: your IP address and the signal strength of any wireless network near you. That information is then sent, if you approve it, to Google, which returns the coordinates you are at the moment.

[...]

If your wireless reciever is turned off, or you’re at a stationary computer, all calculations are based on the IP number. These kind of lookups are quite arbitrary and inaccurate, I just get to the nearest big city when trying to use it over a non-wireless line. But mobile connections are slowly taking over landlines, so I guess this problem will solve itself automatically.

According to this article, Google only uses my IP address if I am using a desktop. However, when I use a VPN to go online (and I can confirm that another IP geolocation service shows me as being on another continent), Google Maps is still able to accurately show my location. How does this work?

share|improve this question
4  
I'd guess it's got something to do with cookies and/or personalization. –  Iszi Jun 19 '12 at 20:27
    
Because it's picking up your local VPN endpoint somehow. –  Fiasco Labs Jun 19 '12 at 21:17
1  
change your router.. google obtained the mac of your router, when making google maps. I changed my router after it died, and I no longer appear. –  user15571 Nov 1 '12 at 9:37
    
Also if you are on IPv6 most likely the VPN service will not cover all your traffics. It happened to me with ipvanish. Google stopped to see my real location only when I turned off IPv6 on my browser. Read also: blog.dave.io/2011/06/vpn-ipv6-privacy –  Giggi M Gallerano Oct 2 '13 at 11:49
add comment

8 Answers

up vote 16 down vote accepted

If you consent, Firefox gathers information about nearby wireless access points and your computer’s IP address. Then Firefox sends this information to the default geolocation service provider...

https://www.mozilla.org/en-US/firefox/geolocation/

Firefox knows the IP address, which is used to connect to the VPN provider. Many geolocation services, however, only look at the IP address they see from the server side.

By the way: With java installed, a website can read the local ip-address without asking for permission.

new Socket("http://example.com", 80)).getLocalAddress().getHostAddress()

example.com needs to be replaced with the name website to obey the same origin policy.

share|improve this answer
1  
I suspect this has less to do with "your computer's IP address" and more to do with nearby wireless access points (that Google has an inventory of). My local machine's IP address is of no use unless I'm using a public IP address. If I'm using any RFC1918 address, and I'm tunneling my traffic through a VPN then IP address is not the information giving up my location. –  BZink Dec 13 '12 at 20:04
    
I also suspect, google being google, they could be using a number of heuristics to 'guess' location. I have noticed google reporting incorrect location information when using a desktop with a wired connection. I'm in a rural location and google will often report me as being in the nearest large metropolitan location. My guess is that if you live in a major city, google's guesswork/voodoo will frequently be correct, but if your in a regional/remote locaiton, more often than not, it will be incorrect unless your using a device with geo-loc facilities. –  Tim X Feb 28 '13 at 23:05
add comment

One possibility is that modern browsers support a feature called the Geolocation API which states the following:

Common sources of location information include Global Positioning System (GPS) and location inferred from network signals such as IP address, RFID, WiFi and Bluetooth MAC addresses, and GSM/CDMA cell IDs, as well as user input. No guarantee is given that the API returns the device's actual location.

This api can be accessed from JavaScript if the user grants permission. Without a position device (like GPS) this API will throw an accuracy warning, but can still provide location information.

Warning: Google maybe using other voodoo to determine your location, after all this is Google...

share|improve this answer
1  
+1 if only for the "other voodoo" comment. I'm always fairly amazed at how Google is able to accurately predict or otherwise derive information (i.e.: search auto-completion) which I have not yet given it. –  Iszi Jun 19 '12 at 20:56
3  
@Iszi Rory or Isznti very true, on a side note I once found my socks by sacrificing a squirrel. Voodoo is powerful. –  Rook Jun 19 '12 at 20:57
4  
I just noticed that, aside from the "Google voodoo" comment, this answer doesn't really address the situation posed in the question. The user suggests that the only geolocation-relevant information he expects is available from his computer, is his IP address. Since it's a desktop, he probably doesn't have a GPS or Wi-Fi adapter. Bluetooth isn't entirely unlikely, but I'm not sure it can be presumed. (And, with Bluetooth's relatively short range and wide mobility, does Google really have enough information to correlate that? This is the first I've heard of it.) –  Iszi Jun 19 '12 at 21:12
3  
@IsziRoryorIsznti No voodoo. The browser knows the local ip and reports that to the geolocation service, if permission is granted. –  Hendrik Brummermann Jun 21 '12 at 8:03
add comment

Are you running NoScript?? Google uses JavaScript to find out most of its data, along with cookies, Flash Cookies, and metadata. Try clearing your cache, clearing your cookies, and using a different browser if you really want to fool google maps, also don't log in to google before you check. You most likely can't fool Google unless you are completely deleting everything in your browser and blocking Javascript, but Javascript is needed to do anything with Google, so good luck. Also see http://samy.pl/evercookie/ to see how many different ways there are for anysite to track you.

share|improve this answer
2  
Alternative to clearing cookies/cache: Run in Private/Incognito/Whatever-Your-Browser-Calls-it Mode. Or, load up a freshly built VM with your VPN software and try from there. –  Iszi Jun 19 '12 at 20:53
    
I have NoScript installed, cleared all the cache, cookies and everything. But I need to turn off NoScipt in order to get google maps to work properly. What I am trying to understand is that, I am connected to a VPN and I expect to see the location of the VPN server in google maps –  user10732 Jun 20 '12 at 17:34
add comment

When you are using a VPN your routing table gets modified and added the networks for which you can access. Perhaps I misread your question, but according to my understanding from your question - You are routed to Google through your internet connection and not the VPN. Unless you are going to Google from a terminal server through your VPN, which renders my answer invalid.

share|improve this answer
1  
He is connected to a VPN and thus all traffic is suppose to go through the VPN. My guess there is a combination of factors for instance Google is able to get his actually end point. –  Ramhound Jun 20 '12 at 10:47
    
I believe you are making a mistake here, my friend. If I am connecting to my organization from home with, let's say a Checkpoint VPN client, upon connecting, my routing table is modified and all of the traffic directed to the "new routes" in my routing table is tunneled to the organization firewall. If I did not get routes to Google, then I will go through the internet. This is mainly the idea of what's called a "VPN Domain" or "Encryption Domain". Please correct me if I am wrong, always happy to learn new things :) –  Franko Jun 20 '12 at 15:47
1  
@Ramhound, I am thinking exactly the same thing. I am sending all traffic over VPN connection. –  user10732 Jun 20 '12 at 17:43
    
@Franko, could you please explain a bit more? –  user10732 Jun 20 '12 at 17:45
1  
In my job, many times I encounter the scenario of a remote access user connecting from home to his office with a VPN connection, and for some reason the user can't access a certain resource on the office network. We then find out that the required resource is not a part of the VPN domain for this user, and hence he tries to access it from his internet connection, and not through the VPN. a simple trace command can show you that. Hope I made myself clear. I repeat - This answer is only valid in case you are not accessing Google through an office resource over the VPN (terminal server etc.) –  Franko Jun 20 '12 at 18:22
show 3 more comments

Some good information about how Firefox handles Location-Aware Browsing here and also a bit more detail about the Google Location Services here

If you want to ensure that your location isn't passed by the browser and your using firefox then its quite simple to disable it you just do

  1. In the URL bar, type about:config
  2. Type geo.enabled
  3. Double click on the geo.enabled preference
  4. Location-Aware Browsing is now disabled
share|improve this answer
add comment

Check the site http://simplesniff.com/ from the proxy. Under the Your HTTP headers from the current request are: section, look for these two values:

X-REAL-IP: 192.117.111.61
X-FORWARDED-FOR: 192.117.111.61

One will be your proxy IP, the other will be your "real" IP address, which the proxy is leaking. Most popular proxies, such as Squid, can be configured not to leak.

share|improve this answer
add comment

Do you have Google maps on your cell phone? was that phone with you?

I am pretty sure that if you log into Google on your PC via VPN, but yout phone tells Google where you are they correlate the two and take the Phone's GPS location as being more trustworthy than the Geolocation on the IP address of your browser.

share|improve this answer
add comment

Simply using a VPN service doesn't hide your true identity or your location. There are many ways to be identified and tracked, and trying to plug all of the leaks is pointless.

Instead, just use a different VM for each new identity and location, and always connect it to the Internet using the appropriate mix of VPNs and Tor. Also avoid cross contamination through browsing, accounts, interests and so on.

share|improve this answer
add comment

protected by Community Jul 19 '13 at 7:47

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.