1

Let's say I setup openVPN at home, then I go out.

I connect my ios with openVPN server at home, then I download Netflix app. then I turn off location and any necessary tracking feature on ios. I login with my Netflix account on ios app.

the question is, Can any app know its users using VPN technically? (I think we can Netflix with VPN) I am just using Netflix to give an example. Can any app in general is an more interesting question.

2
  • They would see that you're using whatever ISP is hosting your self-host VPN. If thats a VPS company, it would raise some red flags. If it was a self-host VPN on a residential internet IP range (which your question indicates if the VPN server is a computer in your house), then it would be difficult to detect passively. However, most apps now behave in the same way that malware does, and inspect every aspect of your device even just to play a simple video. Netflix/other apps may be able to tell your iPhone is connected to a VPN, due to the malicious functionality built into the app. – john doe May 26 at 18:12
  • Just a side note: in the case of Netflix your ISP may direct traffic to-from Netflix in a special way. (Because they use so much bandwidth they dedicate a certain pipeline for that traffic... I think Netflix calls it "open connect") If you use the VPN the ISP can't route the traffic in the best way. – pcalkins May 26 at 21:16
2

I don't know whether the Netflix App is coded to detect your interface, but the information is available and it certainly could know you are using a VPN.

To clarify, based upon a comment: Yes, any app can know it's using a VPN.

I don't think Netflix cares how you use your account, and using a VPN to your house is fundamentally the same as using your direct house WiFi.

4
  • but the question is: do they know if someone using VPN. – user16004927 May 26 at 4:09
  • I'm convinced they do. – nethero May 26 at 8:54
  • @KamilKurzynowski, Thank you, just would like to follow up. do you have any "proof" to back up your arguments ? What if we use self-host VPN service where we only use IP from our homes. – user16004927 May 28 at 23:10
  • @user16004927 Depending on the app and their focus on the detection of the VPN, they could use a combination of fingerprinting, they can set a tracking pixel on the website to count the time between response and GET request to detect an additional layer of encryption. There are many clever ways to do that, but I'm not aware of any company that is going this far. Usually they wouldn't go beyond blacklisting public IPs. – nethero May 30 at 15:41
0

As you say, companies like Netflix have a strong interest in detecting if their users are using a VPN, so I'm sure that VPN detection is a full field of study unto itself, and I am not an expert, but I can theorize.


How do VPNs work?

Wikipedia gives a good overview. Basically, normal networking works something like this:

Laptop -> local router -> ISP -> Website

Meaning that when the website inspects your IP address, they see the IP that your ISP is sending your outbound traffic from.

With a VPN your network flow will look something like this:

Laptop -> local router -> Your ISP -> VPN Server -> VPN's ISP -> Website

In this setup, the website sees the IP address associated with the VPN server's ISP.


Detecting VPNs

Disclaimer: Here I am definitely not an expert.

From a quick google for "vpn detection" most of the sites that come up offering me this service seem to be GeoIP databases; so I'm guessing that they have built a list of IP addresses that are known to belong to the major VPN vendors.

... but what if you're not using one of the major VPN vendors?


Using your own VPN

In your scenario, you're hosting your own OpenVPN at home, and connecting to it from, say a friend's house. At the networking level, the website will see traffic coming from your house, no different that if your device was physically there. Now, as you say, the app -- whether a browser javascript or installed app -- is code running on your device, so it may be able to collect local device info like location services, routing info from your network card, send test packets in trace mode, etc, and then send that up to the server to check that they line up with traffic coming from the IP that the website sees you from. I imagine that if the client is a fully-installed

Windows app, then all bets are off, but if the app is running in a sandbox like a browser, or non-rooted Android or iOS with no special permissions given to the app, then some of this more invasive fingerprinting might be blocked. This is an interesting research question that I imagine is ongoing an evolving!

2
  • As you say, companies like Netflix have a strong interest in detecting if their users are using a VPN. I'm not sure that's true! They have an interest in multiple users using the same account. They have an interest in internationally zoning their offerings which typically involves detecting VPN work arounds. I can't think of any reason they would object to you using your own account at your normal location via a VPN. – user10216038 May 26 at 17:17
  • @user10216038 I guess that's right; there is no fundamental reason why they would care if I'm bouncing my traffic off a proxy (of which, a VPN is a special type of proxy). They only care because VPNs interfere with their ability to enforce zoning (and are often intentionally used by users to circumvent zoning rules). Really, the problem is trying to enforce geography-based licensing rules on the internet. – Mike Ounsworth May 26 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.