46

About two months ago I've decided to use a VPN all the time (it's launched at startup) for various reasons, privacy being the first one. But recently I realized that if you agree to share your location when an HTML5 geolocalization pops up in firefox, they can still get your localization pretty accurately (about 3 km away) when my VPN IP address locates me in another country.

Since I'm on a fixed computer without wifi how can they know my localization ?

Improve this question
7
  • 8
    HTML5 geolocation uses a GPS chip, which doesn't need internet at all.
    – dandavis
    Commented Jul 23, 2016 at 14:06
  • 31
    @dandavis "A fixed computer without wifi" is probably a desktop PC. Since when do desktops come with GPS?
    – Damian Yerrick
    Commented Jul 23, 2016 at 15:07
  • 6
    IMO the only sane way to use a VPN is confining the programs you want to use the VPN to a VM and using a second VM as gateway that tunnels all traffic through the VPN.
    – CodesInChaos
    Commented Jul 23, 2016 at 16:51
  • if your location was based on your external ip, they would not need your permission for that.
    – njzk2
    Commented Jul 25, 2016 at 3:04
  • 5
    A VPN only hides your IP address from sites you access, not from other programs on your computer. (Like your browser.)
    – Ajedi32
    Commented Jul 25, 2016 at 13:18

4 Answers 4

Reset to default
47

I just checked this with my VPN in http://html5demos.com/geo

Although I VPN through Germany, it still shows my nearby location in London.

If you read https://www.mozilla.org/en-US/firefox/geolocation/ , you will see:

If you consent, Firefox gathers information about nearby wireless access points and your computer’s IP address Then Firefox sends this information to the default geolocation service provider, Google Location Services, to get an estimate of your location.

As @Aria noted, Google Location Services uses their collection of WiFi AP to try to pin-point your location. I assume they have a global list of AP SSIDs through the Google Street View project as well as their Android devices.

edit:

FYI, here is the captured request that is being sent to Google. A full list of nearby APs. You might want to launch a proxy and check for yourself.

enter image description here

Also the fact that you are on a computer without WiFi doesn't mean that nearby APs aren't stored somewhere within your computer (Cache, Registry, Logged in Google/Firefox profiles, etc)

Improve this answer
4
  • What's the proxy you're using? I know of fiddler, and this one isn't it.
    – John Dvorak
    Commented Jul 23, 2016 at 14:24
  • 3
    Without WiFi card? How?
    – pri
    Commented Jul 23, 2016 at 16:00
  • 11
    @PriyankGupta: My WiFi router uses the same MAC address for both wired and wireless connections. Maybe Firefox/Google is using the MAC address of the local gateway to identify networks? This, of course, assumes the OP is connected via wire to a router that is also broadcasting a wireless network.
    – poke
    Commented Jul 23, 2016 at 16:58
  • @JanDvorak Burp. (portswigger.net/burp/proxy.html)
    – Iraklis
    Commented Jul 23, 2016 at 20:57
21

A VPN masks your IP address. But the HTML5 geolocation API isn't based on your IP address. It is a Javascript API which can be used to ask the web browser directly where it thinks it is located according to whatever information is available to it (system locale settings, nearby wifi networks, GPS sensors, IP address of the network interfaces as you see them with ipconfig / ifconfig etc,).

When you would like to protect your privacy, configure your web browser to either ask you for permission before giving websites your location or disable the geolocation API altogether. How to do that depends on your web browser.

Improve this answer
3
  • I'm pretty sure it's HTML5, not JavaScript.
    – Hashim Aziz
    Commented Aug 29, 2017 at 1:14
  • 3
    @Hashim The majority of new browser features which are commonly marketed as "HTML5" are actually new JavaScript APIs. Geolocation is among them. It adds a new JavaScript object but no new HTML nodes, attributes or syntax enhancements.
    – Philipp
    Commented Aug 29, 2017 at 8:41
  • Ah, fair enough.
    – Hashim Aziz
    Commented Aug 29, 2017 at 9:15
13

Try disabling HTML5 geolocation if you don't use it. In Firefox, set geo.enabled to false in about:config.

There have been bugs, and there will be again, example 1 and example 2.

Improve this answer
2
  • 11
    The WebRTC security hole is unrelated to geolocation and it's broken-by-design, not a bug. (i.e. browsers won't even try to fix it)
    – CodesInChaos
    Commented Jul 23, 2016 at 16:49
  • All the more reason to deactivate geo AND webRTC I guess... Set media.peerconnection.enabled to false too.
    – Shautieh
    Commented Jul 26, 2016 at 6:02
-6

Your VPN does not route all traffic through the vpn interface - in particular, the encapsulated vpn traffic itself necessarily travels via your normal internet connection - otherwise it could not reach your other vpn endpoint. This may allow to determine your "official" IP (which would be the external IP of your access router in the typical case of a NATted LAN), for example by querying a service like http://whatsmyip.de/ (bypassing a proxy if applicable) or even directly some geolocation service.

Improve this answer
3
  • 1
    A VPN connection in the OP case is a point-to-point connection between your system and an VPN gateway. The only traffic anyone on the way will see (including the infrastructure of your ISP ) is encrypted traffic between your host and that VPN entry point. If you are correctly routed all operational traffic (including browsing) goes though this tunnel. "this may allow to determine your official IP" - who is "this"?
    – WoJ
    Commented Jul 24, 2016 at 11:32
  • "this" would maybe be Firefox, circumventing the proxy/VPN settings because the user asked it to share the user's true location.
    – Nobody
    Commented Jul 24, 2016 at 11:37
  • Your ISP obviously knows your IP address, and being your ISP most likely your billing address and so on. However, the only message that the ISP receives from my device is completely encrypted and addressed to the VPN server. The worst the ISP can do is not pass that message on, which breaks your internet access. If it passes the encrypted message to the VPN server, it cannot modify that message. So the ISP cannot possibly any information that would allow anyone to find out who I am. Obviously if your browser determines your machine location locally, then it can pass it on.
    – gnasher729
    Commented Jul 24, 2016 at 22:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .