VPN location claims don't match real traffic exits

https://ipinfo.io/blog/vpn-location-mismatch-report

by mmaia • 7 months ago

490 321 7 months ago

HotGarbage3• 7 months ago

While exits matter to avoid countries with a nation-wide firewall, the geoip industry is a scourge.

If an ISP wants to help their users avoid geoblocking via https://www.rfc-editor.org/rfc/rfc8805.html more power to them.

londons_explore• 7 months ago

With CGNAT becoming more widespread, formats like this might need expansion to include location data for ports. Ie. Port 10,000-20,000 are consumers in New york, port numbers 20000-30000 are in Boston, etc.

raggi• 7 months ago

Do you have actual evidence of this? What ASN operates this way?

kalaksi• 7 months ago

Sounds awful, though. Maybe we should get more widespread usage for IPv6 instead.

reincoder26• 7 months ago

That is really interesting. I wonder if we have any internal data on this. I will check.

We are trying to work with ISPs everywhere, so if port level geolocation of the IP address is common, we surely need to account for that. I will flag this to the data team. To get the ball rolling, I would love to talk to an ISP operator who operates like this. If you know someone please kindly introduce me to them.

lxgr8• 7 months ago

Why would any CG-NAT split their volume that way?

IPv4 addresses are not that scarce yet, and realistically any CG-NAT will have several IPv4 addresses per metro area, if only to allow for reasonable levels of geolocation (e.g. to not break the "pizza near me" search use case).

dustywusty2• 7 months ago

Can really spot someone who has never had to deal with OFAC with a comment like this. Even if I don't necessarily agree with the concept, or who is actually being blocked, my business is dead in the water if I'm a) sent to prison or b) fined out of existence.

Geographic IP information is one of our best tools to defend against those outcomes, and if anything it should be better.

HotGarbage3• 7 months ago

If you were serious about limiting who uses your services you'd use an allowlist of ASNs. Even then, what about users using US-based residential proxies?

AnthonyMouse• 7 months ago

Even if I don't necessarily agree with the concept, or who is actually being blocked, my business is dead in the water if I'm a) sent to prison or b) fined out of existence.

Is there some specific way we can get the laws like this to be gone? They're obviously useless (witness this very thread of people describing ways for anyone to get around them) and threatening people with destruction for not doing something asinine isn't the sort of thing any decent government should be doing.

lxgr8• 7 months ago

On the other hand, GeoIP is arguably the reason you are in this situation in the first place, i.e., having to use it since it's there and everybody else is doing so as well.

Intentionally ambiguous regulations (in terms of how companies and individuals are expected to comply) backed by the existential threat of huge fines often lead to a race to the bottom in terms of false positives and collateral damage to non-sanctioned users.

boredatoms• 7 months ago

I hope they can use DNS for this instead like they do PTR entries

reincoder26• 7 months ago

We (IPinfo) attended the IETF 3-day workshop on IP geolocation. Our presentation was about geofeed that can be viewed here: https://youtu.be/l8PR7VCmA3Q?si=dG-00UqljTopBquF&t=372.

It was a great session and we received a lot of questions. We attend different NOG conferences regularly. ISPs are incentivized to help us by providing good data. Although we are agnostic about adversarial geofeeds, ISPs themselves need to work with us to ensure good quality of service to their users.

We already do quite a lot of outreach, in fact, most network engineers in the ISP industry across the world are familiar with us. But if any ISP operator has any feedback for us, we are only an email (or even a social media comment) away.

lxgr8• 7 months ago

ISPs are incentivized to help us by providing good data.

That's the entire problem in a nutshell. Good quality of service should not depend on every site I visit knowing my geographic location at the ZIP code or even street level (I've actually seen the latter occasionally).

I can somewhat understand the need for country-wide geoip blocking due to per-country distribution rights for media and whatnot, but when my bank does it, it just screams security theater to me.

Papazsazsa• 7 months ago

Cool, even our privacy protection is fraught with scammers and liars.

kachapopopow• 7 months ago

well to be fair it's not always important to have the server at the geoip since a lot of the time you can measure the real latency of a user behind an ip address anyway.

the only important bit is that it is made clear whenever a given country falls under some category that allows things such as traffic analysis and cataloging.

it's actually often times preferrable to lie about the server location for lower latency access geo-blocked content, particulary when accessing US geo-restricted content in europe.

if you want true privacy you have to use special tools that not only obfuscate the true origin, but also bounce your traffic around (which most of these vpns provide as an option)

balder19913• 7 months ago

Actually, most VPN providers explicitly label the virtual locations as such, I think the famous ones at least do it (ex: Proton and NordVPN even explain them in their respective docs).

reincoder26• 7 months ago

I work for IPinfo.

No, the article does not make this conclusion at all! It was carefully written to highlight the nature of virtual locations of VPN exit nodes and does not make such conclusions.

The article is written by our founder, who is accessible to the VPN industry at large and is open to feedback and comments.

flexagoon• 7 months ago

I work for IPinfo

Ngl, I never knew that those IP location tools are actual companies with full time employees. I always assumed they were just made by some random guy in an afternoon by wrapping maxmind API. Interesting to hear that that's not the case (at least for ipinfo; maybe some of the consumer-oriented IP lookup websites are like that)

Beijinger3• 7 months ago

I am not sure that I really understand what they did. I am also missing some major VPNs in the list. I currently use AirVPN but this has something to do with my use case and pricing.

Why do you want to use a VPN?

- Privacy

- Anonymity (hint: don't!)

- unblock geolocation

- torrents

- GFC

The last point is the hardest.

https://expatcircle.com/cms/privacy/vpn-services/

luckylion2• 7 months ago

I am not sure that I really understand what they did.

They checked where the VPN exit nodes are physically located. A lot of them are only setting a country in the whois data for the IP, but do not actually put the exit node in that country.

Beijinger3• 7 months ago

Yes, I don't understand the advantage or disadvantage of this. Let's say I need a Colombian IP address, I would figure it out pretty quickly it this was not genuine, except if the geo-block protection would be fooled too.

Most of the "problem" countries are tiny places. Monaco, Andorra etc. It might be tough to rent a server there. And your list of clients should be minimal.

Fernandadsc• 7 months ago

I work at IPinfo, thanks for your comment/feedback. We will be expanding this research to include more VPNs next year.

Beijinger3• 7 months ago

Yes sure. Please include AirVPN and Astrill.

But again, it depends on your use case. Very few can drill thought the GFW

illusive40803• 7 months ago

Mullvad is the only VPN I will ever trust. Yet again they ace the test.

cedws• 7 months ago

Not sure why you've been downvoted. Somebody protecting their business?

flumpcakes3• 7 months ago

I also use Mullvad VPN exclusively for my VPN needs. The fact I can get 6 months of access with a scratch card bought from a store & my account is just a random integer number is an example of privacy by design: no email, no phone numbers, no credit cards. I don't even do anything illegal, I'd just rather have a (what I feel) trusted option when I want to browse the Internet anonymously.

illusive40803• 7 months ago

Can you buy those in US stores?

I’ve been paying for Mullvad with Monero for years. Love it

gspr• 7 months ago

You can even just randomly generate such an ID number, write it on a piece of paper and enclose it with cash in one of several currencies, and post it to them.

drnick15• 7 months ago

The best thing is that they accept crypto. I wouldn't want to pay for a VPN with a credit card in my name.

hxtk• 7 months ago

But you have to get money into your crypto wallet somehow, which makes it relatively easy to deanonymize for most users (serious crypto privacy enthusiasts could of course pay cash for their crypto or perhaps mine it themselves) if they're looking at your traffic specifically, but hard if you're only worried about bulk collection.

IMO the coolest privacy option they have is to literally mail them an envelope full of cash with just your account's cash payment ID.

jopsen• 7 months ago

I wouldn't want to pay for a VPN with a credit card in my name.

Wow, you must be using the VPN for some seriously shady stuff.

someNameIG• 7 months ago

What actual extra privacy does that add though? You still need to connect to them from your IP address, which can be traced back to you.

why-o-why4• 7 months ago

I tried to use ProtonVPN when I switched over to ProtonMail a year ago. But so much of the web does not work when you're on a VPN. For example even HackerNews has VPN restrictions. More and more sites know where VPN endpoints originate. How will VPNs prevent this in the future without them just become easy to block?

barfoure• 7 months ago

Same issue exists with Tor exit nodes. It’s anonymous in that you have a hoodie on with a giant spotlight right on you.

bgbntty22• 7 months ago

A better metaphor would be that Tor and VPNs are like wearing a mask in public. It's obvious that you're trying to be anonymous, but you're still wearing a mask, so no one knows who you are.

You may be denied entry to certain establishments, but some of the bouncers don't block all masks and if you're persistent with changing your mask (Tor or VPN exit node), there's a good chance you'll get in. CTRL+SHIFT+L works on Tor Browser to change your circuit. The linked article blocks Tor, but after pressing CTRL+SHIFT+L a few times, I was able to read it.

For the sites that don't let me view them via Tor, I can install FoxyProxy and try some IPs from the free public lists. Lots of sites that block Tor don't block these IPs, although it's a bit of a pain. Another option is to load an archived version of the site on archive.org or archive.md (or .is or the various different TLDs it uses).

As for HN - it sometimes gives a "Sorry." if you try to access a certain comment directly, but after a few tries it works. This account was created over Tor and I've only accessed it through Tor. I think my first comment was dead and someone vouched for it, but now my comments appear instantly.

I've heard that banking sites don't work over Tor, but I haven't had a need to use Tor for banking, as the bank already knows who I am pretty well.

Most of the big social media sites don't allow Tor, but if I wanted to create a fake account, I'd most likely buy a residential proxy.

So it's not that bad, considering what you get from Tor (and with some VPNs, depending on your threat model) - no tracking, anonymity and so on.

why-o-why4• 7 months ago

there was a talk about this at defcon maybe 7 years ago how even going to a tor entry node could get you disappeared in türkiye. same in china (it was something about ethically exploring networks in authoritarian regimes where even pinging a chinese address from the united states could get someone arrested... methinks harvard student was presenting it?)

yieldcrv• 7 months ago

I wonder if using the wifi at a data center has the same broken browsing experience as using a VPN

debian32• 7 months ago

Yes and No. The internet sees it as a datacenter ip and some will degrade the experience based on that. Other are more strict and use a service like ipinfo.io (the op) to know exactly which Ip are used by a VPN provider and block access based on that list.

timpera4• 7 months ago

From a datacenter IP, if the IP address is not shared with other users, you still get blocked from sites like Reddit, but you don't get most annoying captchas (for example on Google).

HotGarbage3• 7 months ago

Apple, for better or worse, has been able to use their size to pressure sites into accepting connections from their Private Relay service.

If VPN usage becomes the norm, sites will have to give in eventually.

dansmith1919• 7 months ago

Only one I have issues with is Ticketmaster, other than that I forget that it’s even on all the time

mdasen• 7 months ago

It’s better than most VPNs, but the amount of Cloudflare challenges I get is really annoying.

It’s a little weird because Apple has device attestation which is run via Cloudflare and Fastly. You’d think that would get you around the challenges, but that doesn’t seem to happen.

Forgeties792• 7 months ago

My bank app forces me to turn my VPN off. I’m not going to change my bank over that and I imagine most others do the same anyway or will eventually. I imagine many sites and services will just continue go “we’re gonna break this thing you need until you turn the vpn off.”

supriyo-biswas• 7 months ago

It’s not a VPN service in the usual sense, and does not allow you to change locations, and they also have a mapping of IP addresses and the served geographical users.

I also assume being a service that requires an expensive device and that the browsing happen through Safari limits the abuse somewhat.

systemtest4• 7 months ago

Even worse is the Reddit approach, where leaving your VPN on will get your account shadow banned permanently. But you are not notified of that, so if you are wondering why nobody is replying to your comments, check in a private session if you can visit your profile page.

jijijijij3• 7 months ago

Check reddit.com/appeals some time after creating an account. If you are auto shadow banned, you can appeal.

why-o-why4• 7 months ago

i can live without reddit and hackernews. i can't live without online banking, bill paying, insurance, healtchare portals, etc.

it is funny i have been probing HN for years, and i've found a number of cases when everything is normal, but i check the account from another device and it isn't there, or is free of posts despite having made many. yet i would do the same if i was an admin trying to keep a walled-garden free of trolls.

drnick15• 7 months ago

How about not using Reddit at all? It's awful.

prism56• 7 months ago

Had exactly this with reddit.

hopelite2• 7 months ago

I wasn’t even aware of that, but it does not at all surprise me, since it fits right in with the trajectory Reddit has long been on; from freedom of information, to full spectrum thought control and digital psychological reprogramming dungeon.

ryandrake• 7 months ago

Wow, very shitty, but I don't expect anything nice out of Reddit. What gets me is: Imagine being the developer writing the system for unaccountable shadowbanning. How do you justify it, ethically? I mean, we all need a paycheck, but come on, at some point one must take a break, walk outside, and think about the effects of the software they are writing. It makes me sad that there are so many in our profession who see that JIRA ticket and say "Yes, boss, no problem, boss, I'll write whatever you ask for, boss!"

matheusmoreira• 7 months ago

They can ban VPNs and Tor because it's affordable. Most of their users aren't using VPNs or Tor. Get enough people to use VPNs and Tor and they'll suddenly become unable to drop the traffic.

The ideal world is one where everyone is using Tor. They can only discriminate against you if you're different from others. The idea behind Tor is to make everyone look like the same user. The anonymity set must be maximized for that to work.

why-o-why4• 7 months ago

thank you. that is a really good point. the economic incentive! i will keep using mine!

coppsilgold• 7 months ago

As VPN usage proliferates such discrimination starts hurting sites more. For example, a VPN may be left on by a user for whatever reason and when the site they visit doesn't work or makes them jump through hoops they are less likely to visit the site in the future or view it with contempt and abandon it a soon as they are made aware of an alternative.

It takes time for sites to realize the danger, especially with mobile users where fiddling with a VPN is often more hassle than its worth and its just left always on. It's often a good idea to impersonate a mobile user agent for this reason as some sites (or perhaps cloudflare?) started treating them differently. The impersonation needs to be done well (SSL and HTTP fingerprints should also match mobile).

Usually, the more expensive the VPN offering the better the reputation of their IP's. Avoid VPNs that have any kind of free tier like the plague.

boneitis2• 7 months ago

less likely to visit the site in the future or view it with contempt and abandon it a soon
fiddling with a VPN is often more hassle than its worth and its just left always on.

Not to saying this is wholly preferable, but I have often found this to be beneficial for me in that it tends to deter me from wasting disproportionate amounts of time on crap web content (either that, or HN wins over that remaining browsing time when it's not blocking me :)

mbesto• 7 months ago

Same. If this is the situation then what is the use case for most "average" consumers?

khannn• 7 months ago

ProtonVPN stinks. Websites refuse to load and I get autobanned on Reddit etc.

Mullvad just worked everywhere. I'm going back when my year plan on Proton ends.

boneitis2• 7 months ago

The consumer VPN heyday has long passed. Most Mullvad endpoints i use are blocked in increasingly more places, including and especially reddit.

It's the only VPN I've tried thoroughly, so i don't know how they and Proton compare today (or, really, ever). The landscape has been degenerating across the board, I reckon.

reimertz• 7 months ago

I know multiple people who worked / working at Mullvad and they take their business, security and privacy _very_ seriously. Not surprised to see them shine here.

ignoramous3• 7 months ago

Windscribe and iVPN up there with Mullvad in TFA.

Mullvad ... security and privacy _very_ seriously. Not surprised to see them shine here.

? TFA reflects on dishonest marketing on part of public VPN providers more than privacy / security.

That said, VPNs don't add much security, though, they are useful for geo unblocking content and (at some level) anti-censorship. In my experience, the mainstream public VPNs don't really match up to dedicated censorship-resistant networks run by Psiphon, Lantern, Tor (and possibly others).

prosody• 7 months ago

Advertising a VPN endpoint in country A which in reality is in country B is a security concern for users trying to reduce their visibility to country B’s authorities. You’re right about the more fit to purpose tools, of course, but they’re more of an impediment to normal internet usage.

pzmarzly• 7 months ago

Coincidentally, Mullvad, Windscribe and IVPN all worked when I was in China behind GFW, while more popular options did not.

Seems like there are VPNs, and then there are VPNs.

godelski2• 7 months ago

I'm a bit curious about how that works. I love Mullvad but routinely I find sites like Reddit completely block it. Even yesterday someone posted a Debian wiki link[0] and I was blocked. It's not all of them but Reddit is a big killer. So I thought China would block all of them (aren't they known?)

Fwiw I'm not switching from mullvad

[0] https://news.ycombinator.com/item?id=46252366

dontlaugh2• 7 months ago

It sort of worked for me, but it was very unreliable. I tried Proton and Astrill, both of which worked much better.

Mullvad is pretty good overall though.

citizenpaul3• 7 months ago

At risk of sounding sale pitch'y. Mullvad is the only VPN the longer I use the more I like it. I've tried MANY competitors first and all the other ones so far seem to only get worse over time.

I love that I can pay directly with a crypto wallet and have true anonymity.

cyanydeez• 7 months ago

crypto is a public ledger. If someone wanted to find you, that's pretty easy target.

Scoundreller2• 7 months ago

Can also mail cash. But you get a 10% discount only on crypto.

We accept the following currencies: EUR, USD, GBP, SEK, NOK, CHF, CAD, AUD, NZD.

Not a bad way to get rid of some spare currency lying about that you’ll incur a fee to localize anyway.

reorder9695• 7 months ago

I do really wish they still provided port forwarding, I understand why they don't but that was really useful and the only competitors that seem to don't exactly seem trustworthy to me.

spiffytech• 7 months ago

I knew they were going to pass the test before I even clicked the article link.

t0mas88• 7 months ago

When they wrote that 3 providers were honest about all locations I have to admit my first thought was "Mullvad, and who would the other two be?"

With their reputation and trackrecord they really can't do any shady tricks. Imagine if they weren't among the 3 honest providers? That would be HN frontpage news.

RestartKernel• 7 months ago

While I pay for Mullvad directly through my bank, their account number approach built a lot of trust for me. "Here's your number, use whatever to fund it. 5 euro a month, no sales."

super256• 7 months ago

Has anyone else from Europe noticed how Mullvad's speeds and latency have becoming worse and worse during peak times in the recent months? I now have to change servers regularly, which was never the case ~2 years ago.

duxup• 7 months ago

It has certainly been wildly variable for me.

eek21213• 7 months ago

This was a dumb study, and if they'd asked the VPN providers, I'm sure someone would tell them why.

All the VPN providers I've used let you select the endpoint from a dropdown menu. I'm not using a VPN to make it appear I'm in Russia, I'm using it as one of many tools to help further my browsing privacy.

My endpoint is one of 2 major cities that are close to me. Could I pick some random 3rd world country? Sure! That isn't the goal. The goal is to prevent my mostly static IP address from being tied to sites I use every day.

EDIT:

Small point of clarification:

All the VPN providers I use have custom or 3rd party software that allows you to select a location for the VPN. All of the VPN providers I've used also select the location with the lowest ping times as a default. I suspect most folks are just sticking with the defaults. I certainly haven't strayed outside the US/EU for any of my attempts. I have occasionally selected an EU location for specific sites not available in the US, where I live, but beyond that?

bloppe• 7 months ago

That's great for you. But some people need to pick a specific country. People in different countries often get different prices for things like airline tickets or online subscriptions. Maybe you need to appear from a particular country to access certain media.

I mostly use it to avoid exposing my IP address too, but if I knew my VPN was comfortable with a little light fraud, I'd be concerned about what else they're comfortable with.

Deathmax• 7 months ago

NordVPN calls out when a location is virtual, so unless ipinfo is claiming they have virtual locations that are not labelled as such, they are at least transparent about it. They did document the physical server locations of their virtual locations at launch, but I'm not sure if there's a live doc for new locations. https://nordvpn.com/blog/new-nordvpn-virtual-servers/

eek21213• 7 months ago

All the ones I use pick one for you, it is up for you to change it, and you play a fat rate per month or year regardless of what you pick.

aerostable_slug2• 7 months ago

Re: random countries, sometimes with PIA the Panama exit has a crazily low ping time (I'm physically in California). I wonder what leads to it? Hawaii I can understand, there's a cable landing not far from my physical location, but Panama is a mystery to me.

ascorbic• 7 months ago

If you look at the list in the PIA menu, you'll see Panama has the "geo-located region" icon, which means that it's a virtual one and isn't in Panama.

ctippett3• 7 months ago

That may be your use case, but it by no means it's reflective of anyone else's. I live in a country that actively blocks and limits your connectivity to (ordinarily) public websites. Choosing an exit point that's in a different country is very relevant and important.

eek21213• 7 months ago

You are in the minority. Most folks that subscribe to VPNs are folks in the US, Canada, EU, and other "First World" countries. (I had a source a while back for something completely unrelated, however I didn't save it)

I'm not discounting you at ALL, I'm simply stating that the majority of traffic originate from these countries. Most of these folks just want to hide their IP address for various reasons. Privacy, Piracy, etc. Most don't care if it's in the next largest city, they just don't want it to appear to come from them.

Folks in countries like yours will likely pick endpoints to bypass the government. Folks up to nefarious stuff like cracking web sites, social media influencing, etc. will likely pick the target country more carefully. Anyone else? Whatever is the default.

I recognize this is a hard concept to understand for folks on this site, but the average joe signing up for a VPN doesn't even remotely understand what they are doing and why. They were pitched an idea as a way to solve privacy issues, block ads, etc. and they signed up for it. The software suggested a low latency link, and they went with the default.

The ads for a lot of VPN providers literally use scare tactics to sell the masses on the idea.

ctippett3• 7 months ago

I get advertisements for VPN providers almost everywhere. I've never been interested, but I do subscribe to Mullvad via Tailscale. So, I'm thankful and appreciative that they did their due diligence and partnered with a reputable provider. I've been very happy with the service.

Edit: Welp. How could this possibly be my most downvoted comment. Am I not entitled to an opinion? I ain't no AI.

reincoder26• 7 months ago

I work for IPinfo. We provide IP geolocation and VPN detection services. We identify which IP addresses are associated with a VPN and the actual location of the IP address.

We have not collaborated with any VPN companies for the report and have not even requested permission or pre-draft approvals. We had the data of what we were seeing and published a report based on that. We have published a ton of resources around the nature of VPN location in the past. Our focus is on data accuracy and transparency.

After the article was published, we received feedback from only a single VPN provider - Windscribe (https://x.com/ipinfo/status/1998440767170212025). I do not think anyone from Mullvad, iVPN, or any other VPN company has reached out to our team or our founder yet.

We are happy to take feedback and comments and are even open to a follow-up!

drnick15• 7 months ago

Looks like the link is dead.

reaperducer• 7 months ago

Looks like the link is dead.

Turn off your VPN?

ramity3• 7 months ago

Contrasting take: RTT and a service providing black box knowledge is not equivalent to knowledge of the backbone. To assume traffic is always efficiently routed seems dubious when considering a global scale. The supporting infrastructure of telecom is likely shaped by volume/size of traffic and not shortest paths. I'll confess my evaluation here might be overlooking some details. I'm curious on others' thoughts on this.

IshKebab2• 7 months ago

I'll confess my evaluation here might be overlooking some details.

Yeah like... physics. If you're getting sub-millisecond ping times from London you aren't talking to Mauritius.

Pyrolol• 7 months ago

The speed of light provides a limit on distance for a given RTT, and taking the examples in the article which are less than 0.5ms and considering the speed of light (300km/ms) the measured exit countries must be accurate.

The speed of light in fiber which probably covers most of the distance is also even slower due to refraction (about 2/3).

ramity3• 7 months ago

Thanks for your informative reply. I see now I was approaching this incorrectly. I was considering drawing conclusions from a high RTT rather than a RTT so small it would be impossible to have gone the distance.

seszett2• 7 months ago

They don't have to assume that traffic is efficiently routed, on the contrary if they can have a <1ms RTT from London to a server, the speed of light guarantees that that server is not in Mauritius EVEN if the traffic was efficiently routed.

It just can't be outside England, just one 0.4ms RTT as seen here is enough to be certain that the server is less then 120 km away from London (or wherever their probe was, they don't actually say, just the UK).

RTT from a known vantage point gives an absolute maximum distance, and if that maximum distance is too short then that absolutely is enough to ascertain that a server is not in the country it claims to be.

ramity3• 7 months ago

I see I was mistaken, but I'm tempted to continue poking holes. Trying a different angle, though it may be a stretch, but could a caching layer within the VPN provider cause these sort of "too fast" RTTs?

Let's say you're a global VPN provider and you want to reduce as much traffic as possible. A user accesses the entry point of your service to access a website that's blocked in their country. For the benefit of this thought experiment, let's say the content is static/easily cacheable or because the user is testing multiple times, that dynamic content becomes cached. Could this play into the results presented in this article? Again, I know I'm moving goalposts here, but I'm just trying to be critical of how the author arrived at their conclusion.

preinheimer3• 7 months ago

We've got detailed global ping data here: https://wondernetwork.com/pings

One of our competitors was claiming a server in a middle eastern country we could not find any hosting in. So I figured out what that server's hostname was to do a little digging. It was >1ms away from my server in Germany.

reincoder26• 7 months ago

We (I work for IPinfo) talk about latency because it is a thread that you can start from when exploring our full depth of data.

We are the internet data company and our ProbeNet only represents a fraction of our investment. Through our ProbeNet, we run ping, traceoute, and other active measurements. Even with traceroute we understand global network topology. There are dozens and dozens of hints of data.

We are tapping into every aspect on the internet data possible. We are modeling every piece of data that is out there, and through research, we are coming up with new sources of data. IP geolocation is only product for us. Our business is mapping internet network topology.

We are hoping to work with national telecoms, ISPs, IXPs, and RIRs to partner with them, guiding and advising them about data-driven internet infrastructure mapping.

atmosx• 7 months ago

Using FreeBSD dummynet it’s possible to modify the characteristics of network traffic and emulate e.g. Somalia performance from a datacenter in France.

systemtest4• 7 months ago

I'm a big VPN user since I am the citizen of one country and the resident of another. Even for government services I have to use a VPN. I tried to access the bureau of statistics of my home country through my foreign residential IP and got 404s on all pages. Enabled VPN and everything magically started working. For watching the election result video stream I also had to VPN but at least that one gave me a clear message. For doing taxes in my home country I then have to disable VPN since all VPN access is blocked but it's OK to use a foreign residential IP.

I would easily pay €30 a month for a VPN in my home country that uses a residential IP and isn't noticeable. I am aware that those exist, but 99% of them are shady.

simlevesque• 7 months ago

I would easily pay €30 a month for a VPN in my home country that uses a residential IP and isn't noticeable. I am aware that those exist, but 99% of them are shady.

For residential IPs you can't even pay per month like normal VPNs, normally they charge per GB, usually over $2 usd per GB.

nemomarx• 7 months ago

Is this be cause they're paying the residential proxy owners some of it?

Scoundreller2• 7 months ago

Damn, I’m throwing away hundreds of dollars per month.

And I can get a semi-anonymous cable internet connection too (if your line is “hot”, you could sign up with any address… not sure if it has to be under the same node or just the same city). Would be difficult, but not impossible, to track down which residence the shadow connection is coming from.

whatevermom2• 7 months ago

Prices are more in the 0.30$-0.45$ range if you know where to go, from my experience.

chmod775• 7 months ago

Do you know anyone in that country who will let you stick an rPI behind their modem?

systemtest4• 7 months ago

I have been thinking about it but it is tricky from a legal standpoint. What I'm trying to arrange next time I visit is to have a secondary line installed at my parents place that is in my name. So that when I pull heavy traffic from that line it doesn't impact them and I can't get them in trouble for posting a message that isn't government approved.

withzombies• 7 months ago

AppleTV has a Tailscale client that you can use an exit node. That's what I do to VPN back to home when I'm traveling.

devilbunny7• 7 months ago

Do you have friends or family in your home country that will run an AppleTV box with Tailscale for you as an exit node?

I can't get into work from a non-US IP, but I can Tailscale back to my house and it works just fine. I even gave my in-laws (who live several states away) an AppleTV box running TS just to have another endpoint if for some reason the power goes out at my house while I'm gone (rare, but happens).

ggrantrowberry• 7 months ago

What is this AppleTV box running TS that you speak of? Sounds awesome.

drnick15• 7 months ago

Why do you need an AppleTV box and Tailscale for that? Use any PC (even a Raspberry Pi or any cheap "thin client") with Wireguard and you remove Apple and Tailscale from the equation entirely while keeping your setup 100% self-hosted.

jddj• 7 months ago

Just get a sim card from home with roaming and use that data to access govt things?

xrmagnum• 7 months ago

I built TunnelBuddy (tunnnelbuddy.net) just for this. I am the same: citizen of one country and resident of another. I have multiple friends and family where I am from. I get them to open tunnelbuddy (nobody needs to sign up), to share a one-off password (like TeamViewer) and I get to access the internet as if I was at their place.

Underneath, it uses WebRTC (the same tech as Google Meet). It is free to use, I just built to fix this problem that I have... I am quite surprised expats only get by using a traditional VPN whose IPs are known by online services...

mmaia• 7 months ago

That's a cool tool.

FYI: There's a typo in the URL you posted, an extra `n` :)

crazygringo3• 7 months ago

Is there any real-life situation in which this matters, though?

If you're picking a country so you can access a Netflix show that geolimits to that country, but Netflix is also using this same faulty list... then you still get to watch your show.

If you're picking a country for latency reasons, you're still getting a real location "close enough". Plus latency is affected by tons of things such as VPN server saturation, so exact geography isn't always what matters most anyways.

And if your main interest is privacy from your ISP or local WiFi network, then any location will do.

I'm trying to think if there's ever a legal reason why e.g. a political dissident would need to control the precise country their traffic exited from, but I'm struggling. If you need to make sure a particular government can't de-anonymize your traffic, it seems like the legal domicile of the VPN provider is what matters most, and whether the government you're worried about has subpoena power over them. Not where the exit node is.

Am I missing anything?

I mean, obviously truth in advertising is important. I'm just wondering if there's any actual harm here, or if this is ultimately nothing more than a curiosity.

AndroTux4• 7 months ago

Yes. Let’s take an extreme example: you think you exit in Japan, but you’re actually exiting in China. This means your traffic will be analyzed and censored by China.

The routers don’t care about where the provider says the IP comes from. If the packet travels through the router, it gets processed. So it very much matters if you do things that are legal in one country, but might not be in another. You know, one of the main reasons for using VPNs.

crazygringo3• 7 months ago

Are any VPN's getting China wrong? It would be pretty obvious. In fact, common VPN's I'm looking at don't even support China as an option. Obviously no VPN's are mixing countries up where it becomes clear from what you're allowed to browse.

But so "if you do things that are legal in one country, but might not be in another" is what I'm specifically asking about. Ultimately, legality is determined by the laws that apply to you, not the country your packets come out of. So I'm asking for a specific example.

And I already said, that if a site is attempting to determine permissions based on the country, it's doing so via the same list. E.g. when the country is actually Greenland, but you think it's the UK, and Netflix also thinks it's the UK. Which is why I'm saying, at the end of the day, is there any real consequence here? If both sender and receiver think it's the UK, what does it matter if it's actually Greenland?

twosdai• 7 months ago

A more general case is for legal and SLAs. If a company uses one of these vpns to make sure their traffic only travels through a specific legal path, and then it's found that their traffic entered a different territory, there can be a lot of consequences.

The case I can think of most accessible would be anything that streams copywriten video.

wongarsu• 7 months ago

Attempting to use a VPN location in Somalia and actually getting routed to an exit in Paris or London is not what I would consider "close enough". That's off by 3000 miles. That's like claiming to be in the Amazon Rainforest in Brazil while being in Montreal, Canada. And apparently 28% of locations are off by at least this much

And if I do it for privacy, the actual exit location seems very relevant. Even if I trust the VPN provider to keep my data safe (which for the record I wouldn't with the majority of this list), I still have to consider what happens to the data on either end of the VPN connection. I'm willing to bet money that any VPN data exiting in London is monitored by GCHQ, while an exit in Russia probably wouldn't be in direct view of NSA and GCHQ

rynn3• 7 months ago

Is there any real-life situation in which this matters, though?

You’d be shocked at the number of people in regulated industries that thinks a VPN inherently makes them more secure. If you think your traffic exits in the US and it exits in Canada — or really anywhere that isn’t the US — that can cause problems with compliance, and possibly data domicile promises made to clients and regulators.

At minimum, not being able to rely on the provider that you are routing your client’s data through is a big deal.

varenc4• 7 months ago

Interesting to learn you can identify the real country/area of origin using probe latency. Though could this be simulated? Like what if the VPN IP just added 100ms-300ms of latency to all of its outgoing traffic? Ideally vary the latency based on the requesting IP's location. And also just ignore typical probe requests like ICMP (ping). And ideally all the IPs near the end of the traceroute would do all this too.

To use an example, 74.118.126.204 claims to be a Somalian IP address, but ipinfo.io identifies it as being from London based on latency. Compare `curl ipinfo.io/74.118.126.204/json` vs `curl ipwhois.app/json/74.118.126.204` to see. If that IP ignored pings and added latency to all outgoing packets, I wonder if that would stymie ipinfo's ability to identify its true origin.

ignoramous3• 7 months ago

It isn't just latency, but "triangulation".

  [IPinfo] pings an IP address from multiple servers across the world and identify the location of the IP address through a process called multilateration. Pinging an IP address from one server gives us one dimension of location information meaning that based on certain parameters the IP address could be in any place within a certain radius on the globe. Then as we ping that IP from our other servers, the location information becomes more precise. After enough pings, we have a very precise IP location information that almost reaches zip code level precision with a high degree of accuracy. Currently, we have more than 600 probe servers across the world and it is expanding.

u/reincoder, https://news.ycombinator.com/item?id=37507355

deegles• 7 months ago

with enough packets you can trilaterate an approximate locatuon. adding random jitter will just delay it a bit.

DANmode• 7 months ago

More than a bit!

debian32• 7 months ago

If you ping it from UK and it ping >10ms then you know its there. And you are triangulating from multiple countries.

varenc4• 7 months ago

You could vary the additional latency based on the location of the IP you're replying to? Or just hash the requesting IP and use that as a seed to generate that particular IP's random extra latency that always stays the same for that IP. Which feels like enough to make triangulation hard. Though I'm just spitballing.

justinsaccount• 7 months ago

Not that simple.

If they added latency to all packets then London would still have the lowest latency.

rplnt• 7 months ago

It's possible to deduce password hashes by timing responses over the internet if the server isn't using constant time comparison. Noise is just that, a noise.

oncallthrow• 7 months ago

If you 300ms latency then yes, you defeat this detection mechanism.

paranoidrobot2• 7 months ago

Only if the detection mechanism is looking at that single IP and from a single location.

Find the ASN(s) advertising that network and figure out their location.

Even within the ASN there may still be multiple hops, and those IPs may be owned by others (eg the hosting facility) who are not playing the same latency games.

reincoder26• 7 months ago

We operate servers for the purpose of measuring the internet using a wide variety of methods. We have more than 1,200 of these servers distributed across 530 cities, running not only ping but traceroute and many other types of active measurements.

In addition to active measurement and research, there are many other sources of data we use. Also, we are actively investing in R&D to develop new sources. Adding just 300ms of latency at the end of an IP address would simply appear as noise to us. We have dozens of locations, hints cut through the noise.

We welcome people to try to break the system. Perhaps it is possible to dupe this system.

____tom____• 7 months ago

Does this really work? I would think the ping time would not be dominated by speed of light, but by number of hops, and connection quality.

As a hypothetical example, an IP in a New York City data center is likely to have a shorted ping to a London data center, than a rural New York IP address.

rileymat2• 7 months ago

The speed of light sets a minimum bound even if you don't account for that, and these are coming up less than the minimum bound.

It also reminds me of this old story: https://web.mit.edu/jemorris/humor/500-miles

paranoidrobot2• 7 months ago

Once you know the exit IP you can just find network(s) advertising it.

The VPN provider only controls their network, not their upstream.

So you can set minimum latency on your responses. But your upstream networks won't be doing this.

_ache_• 7 months ago

This can fool someone from one location and only in one way (if you are near Somalia and expect a 10ms latency, a virtual VPN can't reduce latency to simulate been in Somalia). So it have to be dynamic to fool multiple locations to stay probable.

But anyway, *you can't fool the last-hop latency* (unless you control it, but you can control all of it), and basically it impossible to fool that.

reincoder26• 7 months ago

I work for IPinfo.

We also run traceroutes. Actually, we run a ton of active measurements from our ProbeNet. The amount of location data we process is staggering.

https://ipinfo.io/probenet

Latency is only one dimension of the data we process.

We are pinging IP addresses from 1,200+ servers from 530 cities, so if you add synthetic latency, chances are we can detect that. Then the latency-related location hints score will go down, and we will prioritize our dozens of other location hints we have.

But we do welcome to see if anyone can fool us in that way. We would love to investigate that!

Youden2• 7 months ago

Do you run traceroutes and pings in both directions?

In the case of a ping you might think it shouldn't matter but I can imagine a world where a VPN provider configures a server in London to route traffic via Somalia only when a user establishes a connection to the "Somalia" address of the server. You could only test this if you did a traceroute/ping through the VPN.

And I'm not saying this is what's happening but if you just ping the IP from your infra, couldn't stuff like anycast potentially mess you up?

In the case of traceroutes, you only see the route your traffic takes to the VPN, you don't see the route it takes to get back to you, which I think is really important.

varenc4• 7 months ago

If the VPN IP and the last ~4 hops in the traceroute just ignored ICMP pings, or just all inbound traffic, it sounds like that'd make your detection harder?

I've found that this isn't even that uncommon. One of the example VPN IP's on the article had the last 3 hops in traceroute ignoring ICMP. (though TCP traceroute worked). The VPN IP itself didn't, but it easily could!

(feel free to ignore lest we not give bad actors ideas)

horsawlarway• 7 months ago

There's quite a bit of effort in this space.

In my first job out of school, I did security work adjacent to fortune 50 banks and the (now defunct) startup I worked at partnered some folks working on Pindrop (https://www.pindrop.com/).

Their whole thing at the time was detecting when it was likely that a support call was coming from a region other than the one the customer was supposed to be in (read: fraudulent) by observing latency and noise on the line (the name is a play on "We're listening closely enough to hear a pin drop".)

Long story short, it's a lot more than just the latency that can clue someone in on the actual source location, and even if you introduce enough false signal to make it hard to identify where you actually are, it's easy to spot that and flag you as fake, even if it's hard to say exactly what the real source is.

dtgriscom• 7 months ago

Ideally, there'd be a way to subtract lag. (A non-causal network switch? Would be big business...)

cluckindan• 7 months ago

This seems like circumstantial evidence for most VPN providers mostly serving customers who are in the business of spreading targeted misinformation on social media.

snickerer• 7 months ago

I can't connect to this site because my adblocker doesn't like it. It seems to be on the bad-domain-list https://www.cromite.org/filters/badblock_lite.txt. Now is the question: is ipinfo.io on this list for a good reason?

reincoder26• 7 months ago

I can not access https://www.cromite.org/

It redirects to a dead link hosted on aruba.it. I can investigate it.

nervysnail• 7 months ago

Is it not Bromite?

lossolo• 7 months ago

And it's super easy to do. I had my own ASN and my own IPv4 and IPv6 address space, you basically just write whatever you want into RIPE Database objects (or ARIN, APNIC etc.) Today your IP space can be in one country, and tomorrow in a different one.

tallytarik• 7 months ago

Most of these providers are in fact open about the fact that these locations are “virtual”, so it’s misleading to say they don’t match where they claim to be.

There is however an interesting question about how VPNs should be considered from a geolocation perspective.

Should they record where the exit server is located, or the country claimed by the VPN (even if this is a “virtual” location)? In my view there is useful information in where the user wanted to be located in the latter case, which you lose if you only ever report the location of servers.

(disclaimer: I run a competing service. we currently provide the VPN reported locations because the majority of our customers expect it to work that way, as well as clearly flagging them as VPNs)

balder19913• 7 months ago

Yeah, Proton is quite explicit about that: https://protonvpn.com/support/how-smart-routing-works

reincoder26• 7 months ago

I work for IPinfo, and I appreciate your comment.

Our product philosophy is centered on accuracy and reliability. We intentionally diverge from the broader IP geolocation industry's trust-based model. Instead of relying primarily on "aggregation and echo", we focus on evidence-backed geolocation.

Like others in the industry, we do ingest self-reported IP geolocation data, and we do that well. Given our scale and reputation, we receive a significant volume of feedback and guidance from network operators worldwide. We actively conduct outreach, and exchange ideas with ISPs, IXPs, and ASNs. We attend NOG events, participate in research conferences, and collaborate with academia. We have a community and launch hackathon events, which allow us to talk to all the stakeholders involved.

Where we differ is in who our core users are. Our primary user base operates at a critical scale, where compromises on data accuracy are simply not acceptable. For these users, IP geolocation cannot be a trust-based model. It must be backed by verifiable data and evidence.

We believe the broader internet ecosystem benefits from this approach. That belief is reflected in our decision to provide free data downloads, a free API with unlimited requests, and active collaboration with multiple platforms to make our data widely accessible. Our free datasets are licensed under CC-BY-SA 4.0, without an EULA, which makes integration, even for commercial use straightforward.

I appreciate you recognizing that our product philosophy is different. We are intentionally trying to differentiate ourselves from the industry at large, and it is encouraging to see competing services acknowledge that they are focused on a different model.

LunaSea• 7 months ago

If we can pay them in virtual dollars, no problem

preinheimer3• 7 months ago

I'm a co-founder at WonderProxy, we didn't make their list (we target people doing application testing, not consumer VPNs).

We're in 100+ countries, and I'll stand by that claim. It's a huge pain in the neck. In our early years we had a lot of problems with suppliers claiming to be in Mexico or South America who were actually just in Texas. I almost flew to Peru with a rackmount server in my luggage after weeks of problems, that plan died when we realized I'd need to figure out how to pay Peruvian income tax on the money I made in country before I could leave.

We've also had customers complaining that a given competitor had a country we'd had trouble sourcing in the Middle East. A little digging on our part and it's less than a ms away from our server in Germany.

reincoder26• 7 months ago

I work for IPinfo. I have raised a ticket internally, but I think we focused on consumer VPNs for this test.

For our ProbeNet, we are attempting to reach 150 countries (by ISO 3166's definition). We are at around 530 cities. Server management is not an easy task. We do not ship hardware, but operate using dedicated servers, so this reduces one layer of complexity.

To maintain the authenticity of our server locations, we utilize cross-pings and network traffic behavior detection. If any abnormality is detected, the server will be immediately disabled to prevent polluting our data. There will be a ticket to investigate what went wrong.

We pay for each (excluding 3 to 4 servers where the owner and the team really likes us and insists on sponsoring) server. Expansion is an active effort for us, as there are 70k ASNs and about 100 more countries where we do not have a server.

We hope to partner with more ASNs, particularly residential ISPs and IXPs. So, a lot of effort is put into active outreach through WhatsApp, emails, social media and phone calls. We use a number of different data-based techniques to identify "leads".

laz2• 7 months ago

Google, Apple, and Meta (maybe others?) have the data to build a complete GeoIP dataset. None of them will share because there are only downsides to doing so.

When FB was rolling out ipv6 in 2012, well meaning engineers proposed releasing a v6 only GeoIP db (at the time, the public dbs were shit). Not surprisingly, it was shot down.

Youden2• 7 months ago

Could you use RIPE Atlas and its network of probes, at least to fill in areas where it's difficult to get your own probes?

That way everyone benefits.

preinheimer3• 7 months ago

We really don't want to operate our own hardware. The situation in Peru at the time was that there wasn't anyone offering the bandwidth we needed who could actually back up their bandwidth claims. Forget 95th percentile, bandwidth there was straight "you pay for a pipe, we give you that size pipe (but somewhat oversold)". But no one could do more than like 5mbit that was actually more like 3.

radicality• 7 months ago

Oh wow, I had no idea that “virtual location” is even a thing. Imo it should not, I don’t even see a use case for that, it just seems like straight-up lying about the traffic exit location. Glad to see the provider I occasionally use, Mullvad, passed the test.

kelvindegrees• 7 months ago

Yeah, I'm really not seeing how a "virtual location" is any different from outright fraud.

balder19913• 7 months ago

It depends on whether the VPN is lying to you. Proton, for example, makes them quite explicit in the software and even lists them for you here: https://protonvpn.com/support/how-smart-routing-works and seems like NordVPN also has a page explaining that.

timpera4• 7 months ago

Many providers in the list, such as PIA, warn the user when a virtual location is chosen. The point is to get a wider range of countries. Most websites, such as YouTube and Netflix, are fooled by the virtual locations, so it works!

MallocVoidstar• 7 months ago

I used a VPN that had a virtual location of China for a while, which avoided ads on some websites; China blocks those sites, so those sites don't have any ads in China, but the VPN exit wasn't actually in China so it could reach the sites fine.

krick• 7 months ago

I seriously don't quite understand the point of using a VPN that doesn't offer you clean residential IPs somehow (and I don't really know good VPN like that). Most services where I really want to use VPN are well aware of VPN IP blocks and just won't allow any of these famous VPNs (that I am aware of, at least). And services that don't care if it's my real IP or not… well, usually I don't really care about exposing them to my real IP either?

I mean, ok, there are use-cases. But commercial VPNs exist under specific premise, you know, and they just don't offer what they claim to be offering. Unfortunately.

timpera4• 7 months ago

You can pay for a static residential IP on Windscribe, but it's quite expensive.

drewfax• 7 months ago

I use Mullvad through Tailscale’s exit‑node integration, and it’s awesome. They are the only provider I trust these days.

To highlight virtual routing: it’s useful in scenarios where a country blocks VPNs but you still need an IP from that country to browse local websites. In such cases, virtual routing comes in handy. For example, when India required all VPN servers in the country to log user traffic, Proton moved its Indian server to Singapore and used virtual networking tricks to continue offering an Indian IP address.

reincoder26• 7 months ago

I work for IPinfo. I am not sure what routing tricks Proton uses. I have looked into the smart routing and stealth protocol related documentation. I am not sure if Proton does anything unique when it comes to IP location. I am not saying this officially, but I am just curious here.

Smart routing documentation: https://protonvpn.com/support/how-smart-routing-works

'Virtual' VPN server geolocation involves informing IP geolocation providers that their Singaporean servers are located in India. We looked into data and latency-based locations, but the industry at large uses self-reported location information for their data. So, if you use a service that uses IP geolocation provider (that is not us) they will just tell them that the Singaporean IP address is located in India, because that is the information they have and they do not have any other ways to verify it. But at the end of the day, the location information is coming from the VPN itself.

I could be wrong, and there could be technology and technique I am missing, so I am happy to learn. The blog is written by our founder who is accessible to the Proton team if they want to share their feedback with us.

zdc1• 7 months ago

Never heard of Windscribe but their homepage has "Become American" as a feature.

Are you sick of not having access to foreign oil? Do you love using advanced weapons to fuck up someone’s day? Obsessed with manipulating your financial records to make yourself look more successful than you are?

Got a chuckle out of me.

mmwelt• 7 months ago

There was an article on HN not too long ago about how to get a North Korea / Antarctica VPS[1], so this isn't entirely surprising!

[1] https://news.ycombinator.com/item?id=45922850

reincoder26• 7 months ago

That was actually a great article. For us, that is like a crowdsourced bug hunting program. We actually got duped ourselves, and we appreciate the author.

We added additional features for location hint modeling and selection for IPv6 networks. There are a handful of open engineering tickets to understand more about the entire internet infrastructure of the country. Of course, hosting a probe server out there would be helpful.

https://ipinfo.io/countries/kp

We always appreciate feedback like that.

fragmede2• 7 months ago

The one I noticed was after the Texas porn age verification laws went into effect. Setting my VPN to be in Texas was different than when actually connecting to Texas when I visited.

ericdiao2• 7 months ago

Another related but non-VPN story related to IP geolocation:

Big techs (most notably Google) is using the location permission they have from the apps / websites on the user's phones / browsers to silently update their internal IP geolocation database instead of relying on external databases and claims of IP owners (geofeed etc). And this can be hyper-sensitive.

I was traveling back home in China last year and was using a convoluted setup to use my US apartment IP for US based services, LLM and streaming. Days into the trip and after coming back, I found that Google has been consistently redirecting me to their .hk subdomain (serving HK and (blocked by gov) mainland China), regardless of if I was logged in or not. The Gmail security and login history page also shows my hometown city for the IP. I realized that I have been using Google's apps including YouTube, Maps and so on while granting them geolocation permission (which I should not do for YouTube) in my iPhone while on the IP and in my hometown.

After using the same IP again in the US with Maps and so on for weeks and submitting a correction request to Google, it comes back to the correct city. (The tricks of restarting the modem / gateway, changing MAC address to get a new IP is not working somehow this time with my IS.

reincoder26• 7 months ago

Some of our (IPinfo) services are hosted on GCP, and because our service is widely used (with 2 trillion requests processed in 2024) people sometimes say they cannot access our service. It is usually due to how Google's device-based IP geolocation is used. The user's IP address is often mistakenly identified as being located in a country where Google does not offer service.

I have seen a Europe-based cloud hosting provider's IP ranges located in countries where Google does not provide service. This is because these IP ranges are used as exit nodes by VPN users in that country.

Device-based IP geolocation is strange. We prefer IP geolocation based on the last node's IP geolocation. We hope to collaborate with Google, Azure, and other big tech on this if they reach out to us.

ericdiao2• 7 months ago

Yeah. This can be a problem.

The device-based IP geolocation, because the algo is so sensitive and the result can be altered with few devices behind the IP (at least for Google), can be used theoretically steering / trick big techs to believe that the IP is at location it is not, just like VPN providers in your article by publishing "bogon" geofeed etc. This defies their purpose of doing this in the first place: geolocking and regulatory requirements.

The "tech" is already there: browser extensions [1] that overwrite the JS GeoLocation API to show "fake" locations to the website (designed for privacy purpose). also dongles are available on gray market that can be attached to iPhone / Android devices to alter the geolocation API result by pretending it is some kind of higher precision GPS device but instead providing bogon data to the OS. Let alone after jailbreaking / rooting your device, you can provide whatever geolocation to the apps.

[1] https://github.com/chatziko/location-guard

majke• 7 months ago

Back in 2022 I published a doc on how the egress IPs work at Cloudflare:

https://blog.cloudflare.com/cloudflare-servers-dont-own-ips-...

In summary, the location at which an IP egresses Cloudflare network has nothing to do with the geo-ip mapping of that IP. In some cases the decision on where to egress is optimised for "location closest to the user", but this is also not always true.

And then there is the Internet. Often some country (say Iran) egresses from a totally different place (like Frankfurt) due to geopolitics and just location of cables.

reincoder26• 7 months ago

So, there is a dashboard internally for that. When we do ProbeNet PoP assessment, we have a high-level overview of the frequent and favored connections. We have a ton of servers in Africa, and there is a strong routing bias towards France, Germany, and the UK instead of neighboring connections.

Everyone in our engineering and leadership is very close with various CDN companies. We do echo this idea to them. It is not IP geolocation; we actually have a ton of routing data they can use.

fguerraz• 7 months ago

ProtonVPN clearly marks these “virtual locations” in their UIs as “smart routing”, so there really isn’t any deception here https://protonvpn.com/support/how-smart-routing-works

hopelite2• 7 months ago

That seems reasonable, but they seem to be suffering their own problem with UI and UX design by not making that inherently clearer.

I was getting a bit disappointed about Proton based on this evaluation even though the only problem I’ve had is their really lacking client UI/UX. They should make that visualization clearer. I don’t know the answer, but maybe offering a toggle or expansion for virtualized servers, might be a step in the right direction.

The design issues seems to be a common challenge with proton. The VPN client functions, but it is really grating how basic it is. You can’t even sort, let alone filter servers by load, let alone performance; so you’re scrolling through hundreds of servers. You can’t add regions or even several servers to create a profile with a priority, you have to pick a single server, among hundreds if not thousands in some countries. Oh, and as you’re scrolling through hundreds of servers for a single country, it’s a view of something like 10 lines high.

It’s bonkers

wildzzz• 7 months ago

Surfshark has many labeled as "Virtual" but doesn't really give a good explanation as to what this means.

DavideNL• 7 months ago

I've been using ProtonVPN for many years, and agree, the UI is quite terrible...

fauigerzigerk• 7 months ago

It's not marked in the Chrome extension UI.

PeterStuer• 7 months ago

Just an aside, and not trying to excuse the potential VPN operator's misrepresentation.

Regulatory accepted establishment of "country" location might not always be what layman think.

I knew of a server rack physically in a Brussels Belgium datacenter that was for regulatory purposes declared to be Luxemburg territory (as Luxemburg at the time had specific rules on domestic data processing).

dlahoda• 7 months ago

As per report, 3 providers do not lie.

I searched VPN which payed in crypto and OSS friendly. Mullvad and IVPN were in list, and these also do not lie about exits.

IVPN bought me with very deep transparency into company and WRT support, on top of Linux and Android.

I get maximal longest sub in one payment.

Mullvad is under North EU jury, IPVN under Gibraltar(which is nor exactly UK). So decided offshore like place also more safe against VPN control attempts.

Searched for decentralized VPNs(like TOR, but you pay for speed and do not care onions) some time ago too, we are not there yet.

neya• 7 months ago

Extremely disappointed to see ProtonVPN in this list. Despite others claiming about their smart routing as being a disclaimer of sorts, I am still disappointed that it was never explicitly clear that our privacy was still at stake.

https://protonvpn.com/support/how-smart-routing-works

nizbit• 7 months ago

Yeah happens to other “vpn” solutions like zero trust solutions like zscalar. Logs says the user in Buffalo, IP is in Toronto. Same for users on the southern border, us location and Mexican ip.

ris• 7 months ago

Zscaler enrages me with their use of the term "zero trust" in marketing, because due to their MitM-ing of TLS, they become a single-point-of-interception for all your organisation's traffic. "100%-trust" would better describe it for me, as you have to have 100% trust of Zscaler and anyone who has admin access to your organisation's Zscaler account.

eviks• 7 months ago

This article fails to distinguish between false claims and true claims - VPN providers sometimes explicitly mark some locations as virtual, so there is no mismatch between the claim and the real exist as the title says, because the original claim was never "Bahamas is a physical exit"

xp84• 7 months ago

This is interesting because for some people, it would be a feature to be operating with, say, a US VPN tunnel that is “on paper” in the Bahamas. Better latency. For instance, the average person downloading Torrents.

Of course, for the most high-stakes stuff if you were worried about some kind of major state level actors or something, you want to keep a very tight control over where your actual traffic is physically transiting. So it seems only proper that they disclose these discrepancies to customers.

Even still, I suspect encryption and proper lack of logs provides sufficient cover for most people for most actually likely threats.

VPN location claims don't match real traffic exits

Related Stories