Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am using a VPN (NordVPN). I am seeing the VPN IP in browsers - this is ok. However when I check the Maps apps on my mac, it shows my true location. How can I ensure that my true location is hidden through all applications on my mac?
I am using a Macbook Air 2020. I know that mac laptops do no have a gps chip and are located through wifi. How is Maps still getting my true location?
I tried adding the VPN DNS addresses in my network settings but it is still not hiding my location.
WiFi-based geolocation is not the same as IP-based geolocation (the latter is ridiculously inaccurate, in some cases unable to be more specific than the country and usually off by at least a city or two). WiFi-based geolocation scans for WiFi networks in range - no need to connect to them, just get their physical hardware MAC addresses, which are broadcast in the clear - and also each one's signal strength (as a proxy for how close by it is). The geolocation software then compares list of access points to a database of known access point locations (typically by sending a request over the network, but it could in theory be done using a totally local database). If it can get even one match, it can tell approximately where you are (though access points sometimes move, so this isn't perfect). If it can get two matches, it can approximate where you might be along a line between their known locations, though usually there are two equally likely candidates. If it can get three matches, it can do true triangulation, which can in theory locate you precisely. In practice, of course, it's not that accurate; the signal gets attenuated by walls and plants and nearby cars and so on, and the transmit strength might not be constant over time, and the locations of the access points themselves is usually approximate, all of which degrade accuracy. Still, WiFi-based geolocation, with a good database of access points, can usually identify what building you're in, and sometimes what room.
As a side note, the database of locations is usually built up by devices that do have GPS as well as WiFi, and ideally that move around. In other words, mostly smartphones. They periodically send updates to various servers saying where they saw what access points; with enough such info, the location of the access points can be established with pretty good precision. Of course, by necessity reveals where the phone has been too. You can usually turn off this behavior in the OS privacy or location settings (on my phone it's under Settings -> Location -> Location Services -> Google Location Accuracy -> Improve Location Accuracy), but note that doing so might also make your phone slower to get location info (it's faster for your phone to use WiFi geolocation than to get a GPS fix, if it hasn't used the GPS recently) as the same toggle usually controls both.
To answer your question: turn off WiFi entirely. Possibly Bluetooth too, I don't know if they try using that for geolocation (probably not, given its short range and lack of anything very like access points, but it could be attempted with e.g. smart home stuff). You can still get Internet over a wired connection if you want.
Alternatively, it might work to disable the location services functionality in your device. Generally speaking, apps don't actually have the ability to scan for nearby WiFi networks themselves, and wouldn't want to implement the logic for it anyhow; they offload this to an OS service. I don't know exactly how to do this on MacOS, but on Android and Windows, you can turn off all location services from the OS settings or quick toggles.
However, a sufficiently-privileged app could still implement WiFi-based geolocation itself, if your WiFi was on, even with the OS location services turned off. Disabling, EM shielding, or outright removing the WiFi hardware is the only way to be (mostly) sure (cutting Internet access will also help but I wouldn't count on there not being a local DB).
