VPN location claims don't match real traffic exits

Windscribe and iVPN up there with Mullvad in TFA.

> Mullvad ... security and privacy _very_ seriously. Not surprised to see them shine here.

? TFA reflects on dishonest marketing on part of public VPN providers more than privacy / security.

That said, VPNs don't add much security, though, they are useful for geo unblocking content and (at some level) anti-censorship. Though, in my experience, the mainstream public VPNs don't really match up to dedicated censorship-resistant networks run by Psiphon, Lantern (and possibly others).

Do you have friends or family in your home country that will run an AppleTV box with Tailscale for you as an exit node?

I can't get into work from a non-US IP, but I can Tailscale back to my house and it works just fine. I even gave my in-laws (who live several states away) an AppleTV box running TS just to have another endpoint if for some reason the power goes out at my house while I'm gone (rare, but happens).

> I would easily pay €30 a month for a VPN in my home country that uses a residential IP and isn't noticeable. I am aware that those exist, but 99% of them are shady.

For residential IPs you can't even pay per month like normal VPNs, normally they charge per GB, usually over $2 usd per GB.

Do you know anyone in that country who will let you stick an rPI behind their modem?

with enough packets you can trilaterate an approximate locatuon. adding random jitter will just delay it a bit.

It isn't just latency, but "triangulation".

  [IPinfo] pings an IP address from multiple servers across the world and identify the location of the IP address through a process called multilateration. Pinging an IP address from one server gives us one dimension of location information meaning that based on certain parameters the IP address could be in any place within a certain radius on the globe. Then as we ping that IP from our other servers, the location information becomes more precise. After enough pings, we have a very precise IP location information that almost reaches zip code level precision with a high degree of accuracy. Currently, we have more than 600 probe servers across the world and it is expanding.

Apple, for better or worse, has been able to use their size to pressure sites into accepting connections from their Private Relay service.

If VPN usage becomes the norm, sites will have to give in eventually.

They can ban VPNs and Tor because it's affordable. Most of their users aren't using VPNs or Tor. Get enough people to use VPNs and Tor and they'll suddenly become unable to drop the traffic.

The ideal world is one where everyone is using Tor. They can only discriminate against you if you're different from others. The idea behind Tor is to make everyone look like the same user. The anonymity set must be maximized for that to work.

Same. If this is the situation then what is the use case for most "average" consumers?

Even worse is the Reddit approach, where leaving your VPN on will get your account shadow banned permanently. But you are not notified of that, so if you are wondering why nobody is replying to your comments, check in a private session if you can visit your profile page.

Same issue exists with Tor exit nodes. It’s anonymous in that you have a hoodie on with a giant spotlight right on you.

As VPN usage proliferates such discrimination starts hurting sites more. For example, a VPN may be left on by a user for whatever reason and when the site they visit doesn't work or makes them jump through hoops they are less likely to visit the site in the future or view it with contempt and abandon it a soon as they are made aware of an alternative.

It takes time for sites to realize the danger, especially with mobile users where fiddling with a VPN is often more hassle than its worth and its just left always on. It's often a good idea to impersonate a mobile user agent for this reason as some sites (or perhaps cloudflare?) started treating them differently. The impersonation needs to be done well (SSL and HTTP fingerprints should also match mobile).

Usually, the more expensive the VPN offering the better the reputation of their IP's. Avoid VPNs that have any kind of free tier like the plague.

I wonder if using the wifi at a data center has the same broken browsing experience as using a VPN

They don't have to assume that traffic is efficiently routed, on the contrary if they can have a <1ms RTT from London to a server, the speed of light guarantees that that server is not in Mauritius EVEN if the traffic was efficiently routed.

It just can't be outside England, just one 0.4ms RTT as seen here is enough to be certain that the server is less then 120 km away from London (or wherever their probe was, they don't actually say, just the UK).

RTT from a known vantage point gives an absolute maximum distance, and if that maximum distance is too short then that absolutely is enough to ascertain that a server is not in the country it claims to be.

The speed of light provides a limit on distance for a given RTT, and taking the examples in the article which are less than 0.5ms and considering the speed of light (300km/ms) the measured exit countries must be accurate.

The speed of light in fiber which probably covers most of the distance is also even slower due to refraction (about 2/3).

> I'll confess my evaluation here might be overlooking some details.

Yeah like... physics. If you're getting sub-millisecond ping times from London you aren't talking to Mauritius.

With CGNAT becoming more widespread, formats like this might need expansion to include location data for ports. Ie. Port 10,000-20,000 are consumers in New york, port numbers 20000-30000 are in Boston, etc.

Can really spot someone who has never had to deal with OFAC with a comment like this. Even if I don't necessarily agree with the concept, or who is actually being blocked, my business is dead in the water if I'm a) sent to prison or b) fined out of existence.

Geographic IP information is one of our best tools to defend against those outcomes, and if anything it should be better.

> I am not sure that I really understand what they did.

They checked where the VPN exit nodes are physically located. A lot of them are only setting a country in the whois data for the IP, but do not actually put the exit node in that country.

Attempting to use a VPN location in Somalia and actually getting routed to an exit in Paris or London is not what I would consider "close enough". That's off by 3000 miles. That's like claiming to be in the Amazon Rainforest in Brazil while being in Montreal, Canada. And apparently 28% of locations are off by at least this much

And if I do it for privacy, the actual exit location seems very relevant. Even if I trust the VPN provider to keep my data safe (which for the record I wouldn't with the majority of this list), I still have to consider what happens to the data on either end of the VPN connection. I'm willing to bet money that any VPN data exiting in London is monitored by GCHQ, while an exit in Russia probably wouldn't be in direct view of NSA and GCHQ

> Is there any real-life situation in which this matters, though?

You’d be shocked at the number of people in regulated industries that thinks a VPN inherently makes them more secure. If you think your traffic exits in the US and it exits in Canada — or really anywhere that isn’t the US — that can cause problems with compliance, and possibly data domicile promises made to clients and regulators.

At minimum, not being able to rely on the provider that you are routing your client’s data through is a big deal.

Yes. Let’s take an extreme example: you think you exit in Japan, but you’re actually exiting in China. This means your traffic will be analyzed and censored by China.

The routers don’t care about where the provider says the IP comes from. If the packet travels through the router, it gets processed. So it very much matters if you do things that are legal in one country, but might not be in another. You know, one of the main reasons for using VPNs.

Looks like the link is dead.

Turn off your VPN?