0
  1. I use Pia, arguably one of the most popular paid VPN's on the market today. Imagine this HYPOTHETICAL scenario.
  2. I stay on the East coast, and i use my virtual IP location as the VPN's Datacenter in New York.
  3. My external virtual IP from where i go out onto the internet, is a "shared ip" meaning, the same Pia IP address is used by atleast 100 other VPN customers to send out requests along with me.
  4. Suppose out of the 100 connected VPN customers,there are 20 users using the latest Chrome browser, and all 20 are logged into their respective gmail accounts.
  5. One of the users WHO IS NOT LOGGED INTO GOOGLE, searches for something illegal, illegal enough to BE FLAGGED by google's A.I., and it automatically sends this tip forward to the LEA or multiple 3 letter agencies.
  6. The LEA gets back to google, says we need to know the IP address of who searched for this term/combination of words, and give us information IF SOMEONE WAS LOGGED INTO YOUR SERVICE, while this flagged search term was entered into your search engine.
  7. Google complies, but the google team is also suspicious and apprehensive, because they realize that there are 20 other users who have the SAME IP when they logged in. So, after some deliberation of whether to forward the requested info or hold back because they are unsure/of the request from LEA is too broad, they decide let LEA handle the attribution, we will just give them all we have and exit the situation.
  8. Now, LEA thinks, "its one of these 20guys/girls who has searched for this information, lets try to narrow down by going after these accounts one by one. A very hard task indeed. HOWEVER, THE PROBLEM IS, THE USER WHO SEARCHED FOR THE FLAGGED INFO, IS NOT LOGGED INTO ANY SOCIAL MEDIA OR ANY PERSONAL ACCOUNT.
  9. So, what if LEA does some parallel construction and frames the wrong innocent guy? Could this be possible, that just using a VPN, if some idiot user decides to threaten someone or kidnap someone or email in a bomb threat, then all the 99 other users will be under scrutiny?
Improve this question
1
  • hi forest, i was under the impression from reading about the implementation of vpn's that while it is true that there is a specific port assigned to customers using the same vpn server ip, it is only visible internally by the vpn admins, and they can also see what TAP adapter private ip they have assigned to me in the 10.x.x.x range which is also not visible from the outside. So, while the request out onto the internet may have a specific port per user, that same port is not visible from the outside when the info is sent specifically to the user. Instead its port 1194 used for openvpn udp.
    – nomalokumi
    Apr 5, 2018 at 2:24

1 Answer 1

Reset to default
3

There's a mistake in your reasoning. While you share IPs, you have a unique IP:port combo, and Google certainly records this. This can and has been used to identify individuals behind shared IPs. It's a myth that a shared IP provides better anonymity.

The source port is necessarily sent with the IP address in order for the target website to know how to respond. This is how the concept of NAT, a way to put multiple IP addresses behind a single IP address, works. Otherwise, how could the VPN possibly know which IP address to forward a reply from a website to?

Please remember that VPNs are not meant for anonymity. The internal IP address is what "private" refers to in VPN, so it has nothing to do with "right to privacy", despite what the ads say.

Improve this answer
10
  • i am trying to research this so forgive my delay in posting. i understand the source port for the shared ip is broadcast out, and internally the vpn know which client to forward the request to based on the port matched to the internal private ip in the 10.x.x.x range, but when this data is sent from the vpn server to me, its encrypted udp over port 1197, thats what they say Openvpn transmits over. So, an external party therefore cant see inside this tunnel to determine what port number it is. If this is wrong, then when does the 1197 udp port come into the picture?
    – nomalokumi
    Apr 6, 2018 at 3:14
  • Port 1197 is the port between you and the VPN (it is the VPN destination port). What matters is the source port leaving the VPN and going to a target website. The connection between you and the VPN has a random source port and port 1197 as the dest port. The connection between the VPN and the target site has a per-user port for a source port, and port 80 (for example) as the dest port.
    – forest
    Apr 6, 2018 at 3:39
  • Feel free to correct me where i go wrong in understanding. So, The DESTINATION port for https is 443, udp openvpn is 1197 (or 1194).
    – nomalokumi
    Apr 7, 2018 at 3:12
  • @nomalokumi There are four ports involved when using a VPN. The destination port of the VPN is 1194 (not sure why I said 1197 before), and the destination port of the website for HTTPS is 443. The source port for the VPN is random and irrelevant, and the source port for the website is per-user (because of NAT).
    – forest
    Apr 7, 2018 at 3:16
  • pia uses 1197, standard is 1194 tho. So, The DEST port for https is 443, udp openvpn is 1197 (or 1194). But the source port, is a random port, like i see when i go to ipchicken.com and i keep getting different 'source port' numbers everytime i refresh, while my VPN ip remains the same. ipckicken calls it 'Remote Port'. So for example, it says "Remote Port: 26723" and "Name Address: 109.201.138.xxx", the latter being my vpn exit ip. so, this remote port 26723, is the same that is forwarded on to ipchicken by my vpn server, and the same is visible backward and forward from the vpn server to me.
    – nomalokumi
    Apr 7, 2018 at 3:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .