3

I know similar questions have been asked many times, but I can't find a clear explanation relevant to my case. I use my http proxy installed on my server to access google and it can figure out where I really am, not impressive. Then I set my proxy forwarding to Tor. After signing out google account and clear cookies, google can no longer know where I'm. But if I use Foxyproxy to proxy only google* (this including googleusercontent, google-analytic etc), gstatic, and some youtube related google domains, google can magically find out my real location, not exactly the place but very close to. I inspected requests sent to google in firefox console network tab, nothing unusual. There are only www.google.com, apis.google.com, www.gstatic.com and ipv4.google.com. There should all go through my proxy too. Besides most google services are blocked here and I couldn't possibly visit google without proxy. This difference indicates it could not directly be an issue of geolocation, or wifi hotspot(in this case). There must be something else that hides within the web browser to servers, what is it then?

[EDIT] Additional information:
[ifoolb@server ~]$ nc 0.0.0.0 1080 -l
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Host: modifiedhosts.com:1080
Via: 1.1 fool (squid/3.3.8)
Cache-Control: max-age=259200
Connection: keep-alive

[ifoolb@server ~]$

I just knew that, I have disabled it already. The only thing google knows should just be that someone is using squid. I actually use squid->privoxy->Tor.

[EDIT2]
I've figured out a bit. It's not relevant to foxyproxy, it probably is because of some youtube cookies that make google know my location, as I only deleted all google and gmail cookies. Also the firefox browser must be sending something to google. After clearing all cookies and cache google still displays the .com English site, and the location information at the bottom of the page is 'unknown'. If I switch to private browsing mode, google finally jumps to local site related to the current ip address. Other than cookies and cache, I don't know any additional entities that can be used for identification. I don't set any site specific preference either so the language preference should be identical in both normal mode and private mode. So there is still something strange.

4

1 Answer 1

3

I think your proxy itself is revealing your actual IP address via X-Forwarded-For in request headers. This X-Forwarded-For header is used by proxies to keep track of requests and responses.

This header reveals the full path of the request flow. So,if the request goes like client1(Browser)->proxy1->proxy2 then google.com will receive a header like X-Forwarded-For: client1, proxy1, proxy2

To confirm that this is case you can do as below.

  1. Listen on your server port with netcat (nc -l -p 1080)
  2. Go to http://serverpublicip:1080 via your proxy. Make sure you allow access to this port from the internet.
  3. The request forwarded from proxy will be printed on stdout in the terminal running netcat. Look for X-Forwarded-For Headers which is probably revealing your original IP.

Example :

root@ip-172-31-53-xx:/home/ubuntu# nc -l -p 1080
GET / HTTP/1.1
Host: serverpublicip
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Forwarded-For: MYORIGINALIP
DNT: 1
Connection: keep-alive

EDIT (After Question is Updated)

It Turns out that Google uses some persistent cookies to keep track of user (NID and PREF cookies).

So, I suggest to install Self-Destructing Cookies addon for Firefox, which clears cookies and local storage at regular intervals after tabs are closed.

Also, to get rid of Google persistent cookies follow the below instructions below after installing the addon(copied from here). I didn't copy all the steps mentioned there as I cannot use Gmail, Youtube if i completely block cookies from Google in Firefox.

The problem: Every time you open FF/Preferences/Privacy/Show Cookies/Cookies and remove the PREF or NID cookies, they reappear within seconds or minutes.

To remove and prevent the persistence of the NID and PREF cookies:

(1) In FF/Preferences/Privacy/Show Cookies/Cookies, remove all google.com cookies.

(2) Go to FF/Preferences/Security,

(3) uncheck "Block reported attack sites", and

(4) uncheck "Block reported web forgeries".

This may slightly reduce the security a bit.But this is how to get rid of those cookies.

To make up for that, I suggest you install NoScript (which prevent untrusted Javascript run in Browser) and Ghostery (Block and get rid of Trackers) and Adblock Plus (Block the Ads via Ad networks).

As long as you are confident of what sites you are visiting, and what programs you are downloading you are good to go.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .