306

Google uses BSSID information from your WLAN Access Point to get an approximation of where you are located, even with GPS and WiFi turned off. Taken from “How does Google Maps estimate my location without GPS?”: Google and others like Apple and Skyhook build a Database which links WLAN BSSIDs to a geographic location. A BSSID is like the MAC address of a ...


185

One possible explanation is that DuckDuckGo is using the headers that are sent in your request to determine their display. For example, it is very common to use the Accept-Language header to determine in which language a webpage should be displayed. This header is set by default in all modern browsers based on the language preference settings. My browser, ...


164

The concept is "reducing the threat surface". If there is an expectation that no connections will be made from a certain geographic area, then it makes sense to block that area, because, by definition, it is not legitimate. In theory. (For a health provider, it's a weird choice since customers might want to manage their health while traveling, but this is a ...


158

Yes, you should notify the problem to the company - with caution. Update: a shorter, yet very complete answer was supplied by @crovers. But if you have patience... ...the problem here is not simply the possibility of tracking J. Random Stranger, but rather that: once your ID has been given to someone, apparently you cannot take it back and it does not ...


116

Yes. They ought to be using a long, unguessable string instead of a predictable, short one. I would consider this a security flaw that is relatively simple for them to fix. However, I would caution you - some companies do not handle situations like this very well. Some argue (in my view incorrectly) that changing that id constitutes hacking and they may ...


89

That article is wrong and that website in general seems like a very unreliable source for anything. With the netstat tool, among other stuff, you can see established TCP connections. When you use Facebook messenger (or any other chat), at least one server is between you and the person on the other side, it's not a peer-to-peer connection. Hence the IP you ...


78

The petitions site is purely a mechanism to see whether there may be high enough numbers to support something, and if so, that something will be discussed in Parliament. There are some checks and balances (for example 80,000 fake votes were identified and removed) but there is no need for a strong level of trust here, as nothing is decided by any of these ...


74

First: almost every single site out there is an "IP logger". Every server logs at least this information: IP address of the client Browser type and version Operating system Which site they came from (the Referer) So, not only does this site have your IP address, but each site you ever visited has your IP address in their own logs. A few, very few sites won'...


57

You disabled WiFi and GPS, but you still have cellular data turned on. That means that the phone is in communication with the local cell towers. Android uses cell tower geolocation to estimate your current location. Each cell tower has a set of ID numbers that identifies them to the phones. It broadcasts its identity constantly so that phones can connect ...


47

I had the same problem: Google always responding in my native language, even though I used a VPN elsewhere in the world. I wiped all cookies and so on....to no avail... and then I found that I had an IPv6 leak! Google was using IPv6, and saw my home IP as usual. It wasn't "tracking" me, I just contacted Google straight around my VPN. Do the test here: ...


45

I just checked this with my VPN in http://html5demos.com/geo Although I VPN through Germany, it still shows my nearby location in London. If you read https://www.mozilla.org/en-US/firefox/geolocation/ , you will see: If you consent, Firefox gathers information about nearby wireless access points and your computer’s IP address Then Firefox sends this ...


43

To add to the other answers - be aware of the risks of reporting the problem yourself: If you're inexperienced with reporting security issues, you might come across to them as dodgy and potentially malicious. A company that doesn't have experience with handling security issues might forward your report to the company lawyer rather than the IT department. ...


42

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in that country, and that, whilst really unlikely, it's theoretically possible for IP assignments to change, meaning that if you didn't keep these blocks maintained ...


39

If you consent, Firefox gathers information about nearby wireless access points and your computer’s IP address. Then Firefox sends this information to the default geolocation service provider... https://www.mozilla.org/en-US/firefox/geolocation/ Firefox knows the IP address, which is used to connect to the VPN provider. Many geolocation services, however, ...


26

There are many ways to track user's location on a mobile device (I will go into how that works later). None of the tracking methods are particularly easy to spoof. It can be done but it is simply outside of the realm of the average user as it generally requires either a modified device (physically or programmatically) or external gear. Moreover, it is far ...


23

If I were you, I would say something like Hello, I have mistyped my ID (e.g. 12345) and pressed enter instead of backspace, and I was dumbfounded to find that the page loaded and found the location of a stranger who has the ID next to mine (e.g. 12346). Being able to track someone without their permission seems to be a security problem, as someone that ...


20

General comments Can you be 100% sure that every signature is from a real person? No. Can you take some precautions to make it harder to cheat? Yes. Here are some things that the British government could do (no idea if they actually do it): Require a successful CAPTCHA after X attempts from the same IP. Rate limit by IP. Sure, five persons in the same ...


20

A VPN masks your IP address. But the HTML5 geolocation API isn't based on your IP address. It is a Javascript API which can be used to ask the web browser directly where it thinks it is located according to whatever information is available to it (system locale settings, nearby wifi networks, GPS sensors, IP address of the network interfaces as you see them ...


18

Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why: Many people use VPNs or anonymizing networks such as TOR, meaning valid users may appear to have an IP from a country you don't consider to be part of your target audience. Users of such networks may not use your ...


17

One possibility is that modern browsers support a feature called the Geolocation API which states the following: Common sources of location information include Global Positioning System (GPS) and location inferred from network signals such as IP address, RFID, WiFi and Bluetooth MAC addresses, and GSM/CDMA cell IDs, as well as user input. No ...


17

In addition to @skooog's answer which states that the IP address that you are detecting is not that of the user: IP address geolocation is, at least for IPv4, doomed to fail except in specific edge-cases. Many ISPs dynamically allocate IPv4 addresses, meaning that increased precision gained from a user who enables GPS location on their browser or posts geo-...


17

Any web page you load will have your IP address In order for your browser to download the content associated with a website, your computer will send requests which include your IP address (this is how the data knows where to be sent). However, your antivirus software may have prevented the connection. Depending on how your AV works, it may have prevented ...


16

If you are using the Facebook app on your phone then you have already agreed to let the app access location services. Accessing Facebook through the browser on your phone will ask for your location like this: m.facebook.com wants to use your device's location The IP address will indicate a very rough location like a city or region. The check-in feature ...


15

I don't know if this is how things are done in Britain, but this is how things are done in the Netherlands whenever a petition is submitted to the government: A random sample of the signatures is taken; These signatures are verified (I think they call people to ask if they've signed); the resulting ratio of valid:invalid signatures is then applied to the ...


14

They would be able to see the IP address of the incoming VPN connection (where you're dialing in from) and can perform lookups to see where that IP is registered. This won't give them an exact location, but a city usually. It should also be noted that the information stored within the databases that these whois services reference might contain stale ...


13

The pirate bay used multiple proxies around the world. As soon as one got detected, they switched over to another one. They used preinstalled encrypted images that they deployed at numerous cloud providers around the world. In order to stay hidden, the servers used many different techniques. All traffic between the proxies and the main servers was tunneled ...


13

Try disabling HTML5 geolocation if you don't use it. In Firefox, set geo.enabled to false in about:config. There have been bugs, and there will be again, example 1 and example 2.


13

If you want to spoof your location for the HTML5 Geolocation API you can follow these steps: Go to about:config. Type in geo.wifi.uri. Change the value to something like this: data:application/json,{"location": {"lat": 40.7590, "lng": -73.9845}, "accuracy": 27000.0} (The lat and lng values determine the latitude and longitude of your location.) ...


13

TL;DR - No, this is common on omegle.. In order for Omegle to work. It connects every pair via UDP. This exposes the currently paired client's ip address. They were simply running wireshark, found your IP address and ran a lookup on it. Here is a youtube example of this.


12

The range of possibilities is literally infinite, since the data collection and aggregation typically plays only a minor role in the overall malfeasance, whatever that may be. Typically the worry surrounding location and other PII data is that it could be used to "identify" you in some context. By analyzing where you go, they may be able to deduce your ...


Only top voted, non community-wiki answers of a minimum length are eligible