The CPV paper was not doing what you are saying, defeating a VPN by finding your real location. It is basically the opposite - if you are using a VPN to claim you are in a place, it can verify that you are not in that place. It doesn’t find your location, it can only verify you aren’t in the area you claim to be.
Comment on Youtube can detect VPNs now... the fuck?
finitebanjo@lemmy.world 2 weeks agoAnother thing that only very large companies can do is see the response time and compare packet size from different servers to narrow down your location, effectively defeating the VPN in a lot of cases.
Hypothetically, a specific amount of bytes gets sent to server B, response time indicates it was received 300 miles away which matches the response time of going from Server B to Server A where the user lives.
Of course it’s still important to use a VPN, if only because those big companies don’t want us to.
Crozekiel@lemmy.zip 2 weeks ago
finitebanjo@lemmy.world 2 weeks ago
If you can prove where people aren’t then you can prove where they are.
Crozekiel@lemmy.zip 2 weeks ago
Not really, because the only reason they have a location to test against is because the connection looks like it is coming from the vpn server location. They don’t have any other location data to test against, and even if they decided to then run the test against every possible location on the planet, they still have the issue that their data is heavily skewed by the fact your traffic is flowing through a vpn, so your latency is not going to be perfectly matching their test servers unless they force the test servers’ traffic through the same vpn server.
Nothing about this is setup to find your location on the other side of a vpn - it is basically testing if you are using a vpn or otherwise “spoofing” your location and returning a yes or a no.
finitebanjo@lemmy.world 2 weeks ago
Incorrect. They can test against the recieving computer and any other relays they control on the way there. They can use that along with other information like number of packets, size of packets, and response time to determine, not with any certainty but with probability, where it comes from.
Seefoo@lemmy.world 2 weeks ago
This…sounds a bit like bs. Can you share a more detailed writeup? At best you could get a radius, but that wouldn’t really be helpful
rami@ani.social 2 weeks ago
I imagine they could compile large datasets of ping times and server locations and do some extrapolation. I don’t think it ever goes past a best guess but they’d have an idea (if what this person said actually happens).
lazylion_ca@lemmy.ca 2 weeks ago
Companies dont really need to know where you are. They just need to know where you aren’t. If you are not within a certain threshold of response time to certain cdn servers, then its reasonable to assme that you are to be outside their contractually obligated broadcast region.
Crozekiel@lemmy.zip 2 weeks ago
They kind of have it backwards. They aren’t triangulating your location, they are taking the location your connection tells them you are and tests to see if that is correct or not by checking with known servers in an area around your claimed location. It can verify you are not where you say you are, but beyond that it can’t find you. At least, not the paper the person is mentioning - this “other method” they mention doesn’t appear to be linked to any paper or anything and might just be their personal theory, not sure.
finitebanjo@lemmy.world 2 weeks ago
Yeah there was a cool paper on Delay Response method by AbdelRahman Abdou with Department of Systems and Computer Engineering, Carleton University called “CPV: Delay-Based Location Verification for the Internet”.
The other method I mentioned, checking packet size and general direction, would require accessing data along multiple stops before reaching the other endpoint with which to compare the sizes of encrypted data packets and use that to identify what is traveling where, which either has not been demonstrated or the companies utilizing it haven’t admitted to it, yet. It’s not a stretch to think it’s happening, though, with massive companies like AWS and CloudFlare or telecom giants like AT&T.
i_am_not_a_robot@discuss.tchncs.de 2 weeks ago
The latency to your VPN server is a constant added to the latency between your VPN server and whatever servers you are connected to. As long as the user’s VPN service doesn’t use different VPN servers for different destinations, it is impossible to determine the location of the user behind the VPN based on latency, and in general it is impossible to determine how far a user is from their VPN server because of varying latency introduced by the user’s own network or by bad infrastructure at the local ISP level. You can only know how far they aren’t based on the speed of light across the surface of the earth.
But, without a VPN, this is a real attack that was proven by a high school student using some quirks of Discord CDNs. Even without using Discord’s CDNs, if somebody wanted to locate web visitors using this technique, they could just rent CDN resources like nearly every big company is doing. Of course, if you have the opportunity to pull this off, you normally have the user’s IP address and don’t care about inferring the location by latency. The reason why it was notable with Discord was because the attacker was not able to obtain the victim’s IP address.
finitebanjo@lemmy.world 2 weeks ago
You say what I described is impossible but it’s been demonstrated by researchers such as “CPV end of VPN identify location” by AbdelRahman Abdou with the Department of Systems and Computer Engineering, Carleton University Ontario.
Furthermore, on top of that method, if a company has access to data from servers in multiple places along the chain between endpoints, then they can see that a series of packets of specific size are traveling in a specific direction, narrowing down the location of the other endpoint. A company like Amazon, whose AWS servers make up almost 30% of the internet.
i_am_not_a_robot@discuss.tchncs.de 2 weeks ago
It is impossible. CPV is only going to allow the attacker to know that the device is probably not located next to the VPN server. It can only prove a positive, not a negative.
The second method you’re describing is only possible for people who control internet infrastructure and are able to infer correlations data going into your VPN server with data going out of your VPN server, which is both easier and more difficult than you’re suggesting. The attacker does not need to most of the internet routers because they only care about the data going into and out of the VPN server (it’s onion routing where the attacker needs to control many routers), but the attacker does need to have a powerful enough device to be inferring (hopefully) encrypted network flows on the public network to the packet sizes of encrypted VPN traffic for all of the traffic that is passing through that VPN server at the same time.