Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Browser extension that spoofs your location data to match your VPN

news.ycombinator.com

Post reply on HN
Print view View original

91–99 of 99 posts

Re: Show HN: Browser extension that spoofs your location data to match your VPN

#91

Post by _gyhb »

VWWHFSfQ wrote: post #88
_gyhb wrote: post #84

Earlier quoted context omitted.

I'm unsure if that would work for this extension. Do you have a link to an implementation?

There are a bunch of sophisticated ways to obfuscate it, but it basically boils down to: setInterval(function() { try { let before = new Date().getTime(); // This will pause the program execution if debugging is enabled. // If debugging isn't enabled this statement is a no-op. debugger; let after = new Date().getTime(); // Detect if the program was paused or not. if (after - before > 0.01) { // > 10ms difference? The…

Doesn't seem like this work for detecting the extension.

Re: Show HN: Browser extension that spoofs your location data to match your VPN

#92

Post by _gyhb »

runlevel1 wrote: post #85
_gyhb wrote: post #84

Earlier quoted context omitted.

I'm unsure if that would work for this extension. Do you have a link to an implementation?

I'm not familiar with what happens when `debugger` is eval'd while attached using the debugger API . If it ignores it, you're fine. This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf The debugger timing method is described on page 10.

I don't think that method would work for detecting extension debugging.

Re: Show HN: Browser extension that spoofs your location data to match your VPN

#93

Post by VWWHFSfQ »

_gyhb wrote: post #91
VWWHFSfQ wrote: post #88

Earlier quoted context omitted.

There are a bunch of sophisticated ways to obfuscate it, but it basically boils down to: setInterval(function() { try { let before = new Date().getTime(); // This will pause the program execution if debugging is enabled. // If debugging isn't enabled this statement is a no-op. debugger; let after = new Date().getTime(); // Detect if the program was paused or not. if (after - before > 0.01) { // > 10ms difference? The…

Doesn't seem like this work for detecting the extension.

I'm able to get it to trigger on about ~10-20% of page reloads with your extension activated. Never when it isn't. Maybe it's just a matter of tuning the interval and detection threshold?

Re: Show HN: Browser extension that spoofs your location data to match your VPN

#94

Post by beatthatflight »

thrdbndndn wrote: post #70
beatthatflight wrote: post #45

So I've installed it. I'm tunneling to another country. Vytal says everything is correct for country B. However the site I'm testing posting to still detects that I'm outside their country. And I can't work out how :/

Very few websites/services actually use location to test geo-restriction (especially on browser. it's more common for mobile apps). The most common reason why you VPN didn't work is that they simply block IP ranges of common used (proxy) servers. They also can check if the IP is "Native IP" (means it's actually registered in the country that the server is in.)

I think I've worked it out. They detect VPN/proxies, where there are plenty of libraries to do so.

So I tried creating a VPS in the same city as them last night, used freakin' lynx on a terminal so sans-Javascript, and lo and behold, still detected that I wasn't in their country :/

Re: Show HN: Browser extension that spoofs your location data to match your VPN

#95

Post by beatthatflight »

BlueGh0st wrote: post #46
beatthatflight wrote: post #45

So I've installed it. I'm tunneling to another country. Vytal says everything is correct for country B. However the site I'm testing posting to still detects that I'm outside their country. And I can't work out how :/

Perhaps try a DNS leak test?

I use google DNS - surely that's mostly agnostic?

I think I've worked out how tho. They detect VPN/proxies, where there are plenty of libraries to do so.

So I tried creating a VPS in the same city as them last night, used freakin' lynx on a terminal so sans-Javascript, and lo and behold, still detected that I wasn't in their country :/

Re: Show HN: Browser extension that spoofs your location data to match your VPN

#96

Post by account42 »

beatthatflight wrote: post #95
BlueGh0st wrote: post #46

Earlier quoted context omitted.

Perhaps try a DNS leak test?

I use google DNS - surely that's mostly agnostic? I think I've worked out how tho. They detect VPN/proxies, where there are plenty of libraries to do so. So I tried creating a VPS in the same city as them last night, used freakin' lynx on a terminal so sans-Javascript, and lo and behold, still detected that I wasn't in their country :/

> I use google DNS - surely that's mostly agnostic?

https://developers.google.com/speed/public-dns/docs/ecs

Re: Show HN: Browser extension that spoofs your location data to match your VPN

#97

Post by TechBro8615 »

_gyhb wrote: post #84
runlevel1 wrote: post #83

Earlier quoted context omitted.

The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.

I'm unsure if that would work for this extension. Do you have a link to an implementation?

I don’t have a link offhand but I’ve seen this code while debugging some pirate sports streams. The next upcoming one to check would be an NBA game from “nba bite” (Google it, it’s the offshoot of the banned sports streaming subreddits.)

I think you’re probably right that it wouldn’t detect presence of your extension, since that code runs in its own context and I assume doesn’t actually call the debugger. If your extension injects a script into the page, then that could be detected with this technique or similar.

Re: Show HN: Browser extension that spoofs your location data to match your VPN

#98

Post by TechBro8615 »

traceroute66 wrote: post #36
_gyhb wrote: post #35

Earlier quoted context omitted.

Surely this is a case of commenting something that does not to be commented ? Check out https://vytal.io/ . There are many more data points then just the geolocation api.

> Check out https://vytal.io/ . There are many more data points then just the geolocation api. I think most people would agree that your so called additional data points are worthless for the purpose that most people would be concerned about location data. Something like timezone "location" (which basically what your vytal website is showing) is simply not granular enough to be used for nefarious purposes. I mean, if…

Consider some “people who downloaded and executed ga.js from misinfo.gov.” What is the relative size of these three anonymity sets?

* browser with IP in USA but timezone in Russia

* browser with IP in USA and timezone in USA

* browser with IP in Russia with timezone in Russia

Hint: it’s the middle one. The smaller the anonymity set, the more conspicuous and therefore fingerprintable you are.

Re: Show HN: Browser extension that spoofs your location data to match your VPN

#99

Post by InCityDreams »

_gyhb wrote: post #2

Recently made this extension and interested in getting some feedback on it. Vytal can Spoof your timezone, locale, geolocation and user agent. This data can be used to track you or reveal your location. Most extensions that provide anti-fingerprinting features rely on content scripts to inject script tags into webpages. There are many limitations to script tag injections which you can read about here: https://palant.…

Using Brave browser. Every page, and every reload brings up a "'Vytal' started debugging this browser" message.
Post reply on HN