VPN location claims don't match real traffic exits • Hacker News Board

Re: VPN location claims don't match real traffic exits

#331

Post by AndroTux » Thu, Dec 18, 2025, 2:55 PM UTC

crazygringo wrote: post #129

AndroTux wrote: post #109

Earlier quoted context omitted.

China was just an example. Try to extrapolate on your own. Take someone from Russia, Iran, wherever, trying to access information they aren't allowed to access, or sharing information they aren't allowed to share. They think they're connected to a neighboring country, but in reality are exiting from their own country. Therefore, the traffic gets analyzed and they fall out a window. Imagine Snowden sharing information…

> Try to extrapolate on your own. No need for the snark. Obviously we're not talking about somebody in Iran or Russia connecting to a VPN that just leads back into their own country, that would be idiotic. None of the VPN providers are providing anything like that. Those don't even make sense conceptually. A Western VPN provider that an Iranian or Russian is using isn't even legally allowed to operate nodes inside of…

I really don't understand what you're not getting here. I'm not trying to be condescending, but I explained it as simple as possible. But let's break it down again:

1) You currently reside in Iran for whatever reason.

2) You download, or have downloaded previously, a VPN software that does not tell you where you exit truthfully.

3) You connect to Pakistan, because you want to spread information that is illegal in Iran, but legal in Pakistan. You choose Pakistan because it is near you, so you get better latency.

4) In reality, your VPN exits not in Pakistan, but in Iran. Because they lied.

5) Iran is now able to monitor both your connection traffic to the VPN, and your VPN's exit traffic.

6) You die.

Simple as that. I don't see why this is not a realistic use case in your mind? One very prominent selling point for VPN providers is exactly this. Allowing reporters and other minorities to still safely access the internet in areas in which it is not allowed by law. You don't have to be an Iranian for that. You can just be there, as an international correspondent, using a western VPN, for example. Or you're visiting family after purchasing that VPN in Europe somewhere.

> No VPN providers are accidentally routing into an oppressive dictatorship.

The entire point of this article is that you as the user can't know that. And almost every country is applying some kind of censorship that may or may not affect you. As I mentioned in my previous example, Snowden is a real life situation in which this exact thing would have mattered. He didn't live in an oppressive dictatorship, yet a VPN exiting in Canada vs. exiting in the U.S. would have made a significant difference in safety for him.

Re: VPN location claims don't match real traffic exits

#332

Post by AndroTux » Thu, Dec 18, 2025, 3:07 PM UTC

crazygringo wrote: post #129

AndroTux wrote: post #109

Earlier quoted context omitted.

China was just an example. Try to extrapolate on your own. Take someone from Russia, Iran, wherever, trying to access information they aren't allowed to access, or sharing information they aren't allowed to share. They think they're connected to a neighboring country, but in reality are exiting from their own country. Therefore, the traffic gets analyzed and they fall out a window. Imagine Snowden sharing information…

> Try to extrapolate on your own. No need for the snark. Obviously we're not talking about somebody in Iran or Russia connecting to a VPN that just leads back into their own country, that would be idiotic. None of the VPN providers are providing anything like that. Those don't even make sense conceptually. A Western VPN provider that an Iranian or Russian is using isn't even legally allowed to operate nodes inside of…

You know what? Adding another example from a "non oppressive dictatorship" country: Germany.

Every few years, Germany tries to push for [Vorratsdatenspeicherung](https://de.wikipedia.org/wiki/Vorratsdatenspeicherung), which forces ISPs to store all connection data for later analysis by law enforcement. This is against the German constitution, so it gets overturned after a few years and the cycle starts again.

Point is, if you want your data to not be analyzed by law enforcement, and you live in Germany, you may want to use a VPN and connect to, for example, the Netherlands, where no such law exists.

Now, as we established, the VPN providers lie about it and maybe they don't have an exit point in the Netherlands, so they just let you exit in Germany again.

Same situation as before, but less extreme. Germany now will be able to put together metadata and find out what you were actually doing.

Are you going to jail for that? Maybe, if you did something highly illegal. You probably deserve it in this case.

But this isn't the point of discussions like these. It's always fine until something like Hitler happens and you happen to be jewish. You just can't know how the future will play out, and if your data is stored somewhere, it can be abused. VPNs promise to be a solution to this issue, and they apparently aren't. Which is a problem, even in a healthy democracy.

People like you pretending this isn't a problem, are a problem. It's the same argument as "I don't have anything to hide." Yes, maybe you don't have anything to hide today. Tomorrow? That might no longer be true. Take abortions in the US as a recent example.

Re: VPN location claims don't match real traffic exits

#333

Post by flumpcakes » Sat, Dec 20, 2025, 3:11 PM UTC

phantom784 wrote: post #323

flumpcakes wrote: post #260

Earlier quoted context omitted.

It doesn't defeat the point in my threat model. No one in the position to log my traffic knows who I am other than my source IP address (which is already enough to link it back to me anyway). So let's take Mullvad at their word that they don't log anything, what's the threat now? Maybe Amazon are x-raying the card numbers before shipping them out to customers, but that would require Mullvad giving up the card number…

But then how is that more secure than just paying Mullvad directly? Either way, there's a record of "this person gave money to Mullvad".

Because the people who know who I am, and the people who know what I browse are different. If I paid directly to Mullvad they would know both.

The simple fact they go out of their way to buy their services in this way makes me believe them even more when they say they don't log user traffic, unlike other VPNs.