8

If you connect to your employers VPN, can they tell from your IP address or the wifi you are connected to which state or location you are in?

  • 7
    Yes. There is no direct mapping from ip address to physical location, but there are several online services which will take an IP and resolve it to a physical location with a fairly high degree of accuracy. Depending on the quality of the source data, accuracy might be low (think 100km away from your actual location) or spot on (if you're connecting via your ISP and your ISP is selling location info). In my experience, online location services usually place me at the closest big city, even if I'm in a smaller town nearby. – Pascal Feb 26 '17 at 19:24
  • double VPN? Set up a VPN at home? – Dmitry Kudriavtsev Feb 27 '17 at 6:28
  • Yes I heard about possibly a double Vpn too, has anyone heard of private internet access? That is the name of the company helpdesk.privateinternetaccess.com/hc/… – Yogaforlife Feb 27 '17 at 11:55
14

They would be able to see the IP address of the incoming VPN connection (where you're dialing in from) and can perform lookups to see where that IP is registered.

This won't give them an exact location, but a city usually. It should also be noted that the information stored within the databases that these whois services reference might contain stale information so they're nowhere near fool proof. In addition these whois services typically state the location of the IP address is the location of the ISP office so accuracy can be off by hundreds of kilometres.

  • 2
    @Yogaforlife:Hiding your IP address (which is the information that is uncovering your location) isn't easily doable because that's the address used for sending your data to you! You could log in to your company VPN via a proxy/VPN/tor in order to avoid revealing your ip address (and thus location). – dave Feb 26 '17 at 23:52
  • 8
    @Yogaforlife We don't council people on how to circumvent their companies security protocols. The truth is that if anyone is monitoring VPN logins and the IP addresses associated with them it would be relatively trivial for your IT to see your traffic wasn't originating from within a specific geographic area. Aside from this, any method you could potentially use for this purpose requires you to send your companies proprietary data through a third party (which, I would assume compromising your organizations network security is likely grounds for termination) – DKNUCKLES Feb 27 '17 at 1:13
  • 8
    @dave Routing your corporate VPN access through any of those methods potentially exposes the VPN credentials to interception as you are now implicitly trusting a third party to route all of your traffic. What happens if you route your traffic through a malicious Tor exit node or VPN provider? This is terrible advice imo. – DKNUCKLES Feb 27 '17 at 1:21
  • 4
    @DKNUCKLES: What kind of VPN do you use that isn't encrypted end-to-end? – Mehrdad Feb 27 '17 at 3:10
  • 1
    @DKNUCKLES: Doesn't make sense. The whole point of a VPN is to assume the channel is insecure. That's why it's a virtual private network; we know's it exists on the non-virtual non-secure public Internet. The hotel WiFi is just as hostile as any other VPN in the process. – MSalters Feb 27 '17 at 11:41
6
  • Can they see what state you are in if you're logged via a VPN or TOR?

Probably not if you do it correctly.

  • Will you raise any suspicions by using a VPN or TOR?

Possibly.

  • Can the employer figure out you're working from another state if they want to?

Most likely.

There are just too many things that can give out your location, aside from your IP address. Your time zone which may often be inadvertently revealed by some software such as Git, your daily activity pattern, your ping, your real IP that accidentally ends up in some logs that you share, some kind of a backdoor rootkit your employer may have in your corporate laptop, some random person casually giving out the name of the city you're in while you're on the phone, your... inability to receive any mail and packages to the address where you are supposed to be or to show up for an important meeting.

Perhaps more importantly though, lying is... bad, regardless of any circumstances.

  • 1
    Don't say "lying is bad, regardless of any circumstances" lightly. That's an extremely contentious position and I rather doubt it's what you actually believe, no offense. It would be better to say "lying in this case is almost certainly morally wrong" (or morally bad, or evil), which is what I think you mean to say and also much less controversial. – the dark wanderer Feb 27 '17 at 8:07
  • @thedarkwanderer That is indeed my personal stance. Even the so-called 'white lies' will entail bad and unexpected effects. I do lie occasionally myself to relieve my mental pressure or avoid awkward moments, but I never perceive those lies a truly charitable thing, and oftentimes they "bite me back" eventually resulting in even more unwanted consequences for me and the people I lied to, even if I did not have any bad intentions telling those lies. I have lived and suffered long enough in this life to have a firm stance on this. You are welcome to downvote if you disagree. – undercat Feb 27 '17 at 10:03
  • eh, the rest of your answer is good. It's just less convincing this way than it could be. 'white-lies' I think are more uncontroversially always bad. The complications with lying are things like the famous Anne Frank thought experiment But in any case, if you're actually committed to the idea that lying is always wrong regardless of the consequences, then this is fine. – the dark wanderer Feb 27 '17 at 10:19
0

If they have a VPN for this anyway, why would you need to worry about where you are using it from?

It is possible to circumvent this through some of the means above, at the risk of (in many cases) making things look worse.

Using your phone's WIFI could be one solution, but there are a lot of variables, and probably cost (a VPN would add non-negligible network overhead).

If you do nothing, they can make a guess, in many cases, about where you are. If your not being in a specific state is an issue, unless you live right on a state border, then you would have an issue.

0

Possibly. There's no guarantee, but if this is a risk you should assume they can. There are a few tools that they can use.

IP Address Geolocation Databases

There are a few companies that offer databases where you enter an IP address and they guess where they are physically located. This is an imperfect process, as demonstrated by the infamous Kansas farm case:

As any geography nerd knows, the precise center of the United States is in northern Kansas, near the Nebraska border. Technically, the latitudinal and longitudinal coordinates of the center spot are 39°50′N 98°35′W. In digital maps, that number is an ugly one: 39.8333333,-98.585522. So back in 2002, when MaxMind was first choosing the default point on its digital map for the center of the U.S., it decided to clean up the measurements and go with a simpler, nearby latitude and longitude: 38°N 97°W or 38.0000,-97.0000.

As a result, for the last 14 years, every time MaxMind’s database has been queried about the location of an IP address in the United States it can’t identify, it has spit out the default location of a spot two hours away from the geographic center of the country. This happens a lot: 5,000 companies rely on MaxMind’s IP mapping information, and in all, there are now over 600 million IP addresses associated with that default coordinate. If any of those IP addresses are used by a scammer, or a computer thief, or a suicidal person contacting a help line, MaxMind’s database places them at the same spot: 38.0000,-97.0000.

Which happens to be in the front yard of Joyce Taylor’s house.

But very often these searches will indeed guess if not the state at least the region of the country.

Contacting the ISP

The American Registry for Internet Numbers (ARIN) is the organization that assigns IP address blocks. They have a public searchable database of IP addresses that tells you who they've been assigned to, including contact information. (Here's the result for a Google IP address.)

Your employer could search the IP address and then contact its owners (generally an ISP), and ask them to help them narrow down where the devices with that IP address may have been located at a specific point in time. This could be accompanied by a nice or not-so-nice letter from a lawyer, or even a court subpoena to give it extra oomph.

Reverse DNS lookups

Often the DNS names for an ISP's hosts are organized by geography, and thus have hints as to where the IP address is located. So a reverse DNS lookup for the Google IP address in the previous example gives us the hostname sfo03s01-in-f4.1e100.net, which you might guess is in the San Francisco Bay Area (the San Francisco International Airport's code is "SFO.")

Cell phone geolocation

If your device is a cell phone, similar remarks apply as in the "Contacting the ISP" point, but in addition they can use tower signal data to pinpoint fairly accurately where you were located at that point in time.

Conclusion

You should assume they can figure out your state with minimal effort using a public geolocation database or other public information. And if they're motivated enough to get the law involved, they can likely find out much more precisely than just the state.

References

The Electronic Frontier Foundation has a useful white paper for law enforcement and courts on the proper use of IP address for identifying locations and individuals:

  • Mackey, Aaron, Frank Stanton, Seth Schoen and Cindy Cohn. 2016. "Unreliable Informants: IP Addresses, Digital Tips and Police Raids: How Police and Courts are Misusing Unreliable IP Address Information and What They Can Do to Better Verify Electronic Tips." Electronic Frontier Foundation white paper. Available for download.

Their recommendations to police on how to use IP addresses to identify locations and individuals (section 5) are relevant to your question, so you may want to read it.

-1

You should not even contemplate that. You must be lawful to your employer and hiding the source address without a good reason to do so when connecting to the corporate VPN can be seen as a hostile action(*). If your manager can know that, you should be prepared to explain why you have hidden the original IP address.

As an employer, I would warn that I can admit that you did not realize exactly what you were doing and that anyone should have a second chance. But do not do it again!

That being said, if the protocol is compatible, TOR is normally a good way to hide an IP address. Or if it is relevant you could try to setup a relay in your home, or on a machine in the cloud on which you have administrative rights: you connect to that machine which in turns connects to the VPN. But you have been warned of possible consequences, and you should not expect this operations to be undetected:

  • TOR (and common VPNs) are well known things nowadays, so it is likely that their terminal address is either detected directly as a VPN end point or be in a place where you should not be, a datacenter for example
  • a relay in the cloud is likely to present an address in a range belonging to a large datacenter, where again you have no reason to be
  • an at home relay is probably the safest way... provided you do not post on facebook a photo showing you hundred kms from there or someone else can know that you cannot be there...

(*) It is hostile for many reasons:

  • simply hiding a normaly not sensitive information is suspect at first sight
  • if you use more than the provided VPN to connect to your corporate network, you may add possibility of interception of sensitive informations - after all they provided you with the VPN to protect that connection
  • 8
    Using Tor for work related purposes sounds like pretty bad advice to me. If they are watching the ips then they will notice that you are jumping around the world constantly, and so will raise flags. Also I wouldn't trust Tor with confidential data that one may deal with at work (vpn or otherwise)... – Shadow Feb 26 '17 at 23:47
  • @shadow I was definitely not advising to use TOR nor any other way! Hope it is more clear now... – Serge Ballesta Feb 27 '17 at 7:28
  • I'm glad - cause you had me a little worried :) Thanks for adding a clarification. – Shadow Feb 27 '17 at 9:39
  • Has anyone heard of a company called private Internet access? helpdesk.privateinternetaccess.com/hc/… They are a Vpn so I guess if I use them I would be doing Vpn then another vpn? – Yogaforlife Feb 27 '17 at 11:57
  • You are conflating too many things. There is no reason to suspect that using a commercial VPN is always illegal or always hostile (or almost always either). A VPN is a tool, like any other tool. The intent of the user is separate, same as any other tool. – YetAnotherRandomUser Feb 27 '17 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.