1

I just logged into my FB account from a different location as usual and received a message that my account was locked down due to that attempt from an unknown location. This spiked my curiosity, and I'm wondering, if I was able to change my location to my home address using a VPN (not even sure you can be that specific or not,) would I then be able to log into my account with no issue? I'm sure this is something that's been thought of, but I'm just curious how they would determine that I'm not actually there?

4
  • Sure you can host your own VPN server at home and access the Internet as you were there. I'm not sure how this would be related to security rather than general networking, though. Mar 14 at 6:27
  • 1
    You first need to confirm how Facebook determines your location. If it is simply by IP, then by using proxies or VPNs you can change your IP. If there are other mechanisms they use, then proxy/VPN won't work.
    – schroeder
    Mar 14 at 7:47
  • If you're referring to the Facebook mobile app, it might have access to your phone's location. And that's how it's determining your location. Also, whatever network you're on might have a dynamic IP from another geographic location than the one you're currently at. In which case, Facebook would flag this as a new login from a different location. Mar 14 at 10:52
  • Not sure what your real question is. If it is blocking you when you connect from another location, it will probably blocks you when you connect with VPN. Notice you won't achieve any privacy whatsoever: every login is logged forever with its own address. If you later use a VPN, the IP address you used to connect previously is still in the logs Mar 14 at 11:49
0

The exact mechanism for this check is not publicly known (as far as I know) and might also change over time. Specifically it is not clear if it is actually (only) based on the physical location or if there are other factors. Since this mechanism is part of an anomaly detection to detect account misuse (like stolen credentials) it is based on the user profile (learned or heuristics) and might take the following in account:

  • Huge and sudden changes to the physical location are likely suspicious. How this physical location is determined can vary, i.e. from just looking at the IP address to using the GPS of a smartphone. In order to reduce false positives when traveling one might also track recent activity to find out if the person currently travels.
  • Use of a VPN from some well-known VPN provider (can in many cases be detected by IP address) itself might not be suspicious, since it is not that uncommon. But it might be suspicious if the user has never used a VPN before or if suddenly a different VPN provider is used.
  • Use of a private VPN with a VPN exit "at home" (like offered by some routers) is likely not suspicious, both since the IP-based location did not change but also because it is unlikely that the account is compromised in this case.

How much these heuristics are used in the first place might also depend on how well the account is protected. All heuristics have false positives which might tag something as suspicious even if it is just uncommon but innocent. The same way these heuristics have false negatives which might lead to suspicious activity not being detected. Less false negatives (wanted) usually lead to more false positives (not wanted) so the right balance is needed. Since a simple password based authentication is easier to compromise with credential phishing or keyloggers than a multi factor authentication, it might make sense to temporarily lock a weakly protected account on potentially suspicious activity while keeping a MFA protected account accessible.

0

Probably not. A company as sophisticated as Facebook is, and collects as much data as Facebook does, is likely looking at much more than just the IP address that you are connecting from to determine your location.

For example, FB can easily pickup the timezone that you computer is set to (this is simple to do with a bit of javascript). From the timezone, they can determine your longitude to within ~1000 miles or less. So, for example, if you are in Paris, and your computer is set to the UTC+01:00 timezone (the timezone for Paris); and you connect through your VPN, whose IP address is in NY, Facebook will likely detect that something is awry.

This is just a very simple example. Timezone is just one bit of information that Facebook can pickup. Add this to all of the other information that Facebook collects, and you can quickly see that it's much more complicated than just the IP address that you are connecting from.

What might be a bit more effective is setting up a remote desktop host on the computer at the location that you normally connect from - then connecting by RDP to that computer from wherever you are, then connecting to FB from there. Then, FB might see it as another connection from that same computer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.