Show HN: Browser extension that spoofs your location data to match your VPN | Hacker News Reader

Show HN: Browser extension that spoofs your location data to match your VPN

313 points_gyhb94 comments

Recently made this extension and interested in getting some feedback on it.

Vytal can Spoof your timezone, locale, geolocation and user agent. This data can be used to track you or reveal your location.

Most extensions that provide anti-fingerprinting features rely on content scripts to inject script tags into webpages. There are many limitations to script tag injections which you can read about here: https://palant.info/2020/12/10/how-anti-fingerprinting-exten...

Vytal utilizes the chrome.debugger API to spoof this data. This allows the data to be spoofed in frames, web workers and during the initial loading of a website. It also makes the spoofing completely undetectable.

You can test and compare Vytal and other extensions on https://vytal.io

Unfortunately it doesn't work on Firefox since Firefox doesn't support the debugger API. Works on Brave tho.

> It also makes the spoofing completely undetectable.

It's my understanding that the usage of the debugger is detectable by scripts running on the page. I've actually come across content websites that will refuse to activate their features (play video) if the debugger is active.

Similarly on Android some video streaming apps will refuse to load and play their content catalog if USB debugging is enabled.

How can you detect it? Which websites refuse to activate their features if the debugger is active?

The one I've seen before does the following:

A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open.

Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.

I'm unsure if that would work for this extension. Do you have a link to an implementation?

There are a bunch of sophisticated ways to obfuscate it, but it basically boils down to:

    <script>
        setInterval(function() {
            try {
                let before = new Date().getTime();

                // This will pause the program execution if debugging is enabled.
                // If debugging isn't enabled this statement is a no-op.
                debugger;

                let after = new Date().getTime();

                // Detect if the program was paused or not.
                if (after - before > 0.01) {
                    // > 10ms difference?  The program was (most likely) paused by the debugger.
                    document.body.innerHTML = "<h1>Debugging started</h1>";
                }
            } catch(e) {}
        }, 1000);
    </script>

There are some other ways to detect it by implementing various prototype methods and continually logging the object to the console. The methods are only invoked if the dev console is opened.

Doesn't seem like this work for detecting the extension.

I'm able to get it to trigger on about ~10-20% of page reloads with your extension activated. Never when it isn't. Maybe it's just a matter of tuning the interval and detection threshold?

I don’t have a link offhand but I’ve seen this code while debugging some pirate sports streams. The next upcoming one to check would be an NBA game from “nba bite” (Google it, it’s the offshoot of the banned sports streaming subreddits.)

I think you’re probably right that it wouldn’t detect presence of your extension, since that code runs in its own context and I assume doesn’t actually call the debugger. If your extension injects a script into the page, then that could be detected with this technique or similar.

I'm not familiar with what happens when `debugger` is eval'd while attached using the debugger API. If it ignores it, you're fine.

This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf

The debugger timing method is described on page 10.

I don't think that method would work for detecting extension debugging.

I've had the opposite experience: parts of websites broken by tracking blocker started working after popping debugger up.

I'm commenting here both to remind myself to check back and try this out when I'm not on mobile, and to thank you for building this- at first glance it looks good.

You can save a comment. Just click the timestamp (x hours ago), then click favorite.

Just installed it, it's showing a message on top of each tab in Chrome

"Vytal" started debugging this browser

Is there a way to get rid of it?

There is a note at the link that explains the command line flag you need to pass in

Thanks, I will have to create a shortcut for it.

This should work

chrome.exe --silent-debugger-extension-api

Is it safe to do? I mean I want to stop this message for Vytal only, because I know that it uses debugger API. But I would want to know if tomorrow my adblocker starts to use debugger API.

Any existing extension would have to explicitly declare the appropriate permission for using the debugger API. Chrome automatically disables extensions that add new permissions until you review them.

Using Brave browser. Every page, and every reload brings up a "'Vytal' started debugging this browser" message.

Can you explain how Firefox (or Chrome) knows my location within 20m even if I use a VPN? Brave puts me where I think the VPN exit point is.

For example:

https://wikishootme.toolforge.org/

Many (most?) VPN mechanisms don't entirely remove access to the other routes from apps that manually request them, so even if an app isn't able to use something akin to "location services" on your device it might still easily be able to get access to your other IP addresses by sending requests with sockets manually bound to specific interfaces, and even might choose to lower the priority of information learned using interfaces that are clearly tunnel devices instead of network cards.

Also known as split tunnel, this can be used by corporate VPN solutions to lower the amount of network traffic entering a data center (so you don’t overload your undersized pipes)

No, I don't mean that. That's when you purposefully set your routing table to split some traffic to different paths. The premise here is that even if all of your traffic is supposedly going over a VPN, an app can often opt out of that and do whatever it wants.

> by sending requests with sockets manually bound to specific interfaces

I don’t believe this is possible in client JavaScript within a web browser. Very open to be proved wrong.

I thought the complaint was that the browser was figuring it out directly and then exposing it, such as via the browser's location API, not that the website was figuring it out using non-location network mechanisms provided by the browser.

(FWIW, a website that is given media recording privileges can definitely do that, though, using WebRTC. If you don't have that privilege then you can still use the WebRTC API but it doesn't return alternative candidates. But I also don't think that is what they meant.)

This could also happen if you have a misconfigured VPN with a DNS leak. Check out this website for clues: https://ipleak.net/

I checked and my DNS is not leaked through the VPN. Even if it was, how could that result in such an accurate localisation?

You clicked "Allow" on the location request dialog, click deny and it won't do that.

Of course, but how does it know? Where is the information from?

I'm assuming you mean on devices without a GPS.

There are services that wardrive around mapping locations of WiFi access points. Your laptop periodically will phone home with your nearby Wi-Fi MAC addresses (BSSIDs) to ask where they were detected.

Here's one such service: https://www.skyhook.com/wifi-location-solutions

By the way, if you've ever noticed a brief packet drop or latency spike (usually a few 100s of ms) while pinging a server from your Mac, it might be because your device is doing this.

When Location Services is on (which it is by default), macOS will periodically switch your wireless card to monitor mode to find those nearby SSIDs. That briefly interrupts normal network traffic.

IIRC, it does this more often when Find My.app is turned on.

You can disable Location Services in: System Preferences > Security & Privacy > Location Services

firefox has something called the mozilla location provider, which maps wifi access points to locations, which is similar to what google maps uses when you have gps disabled on mobile

Is there a way to turn that off? I never want my browser location services to work.

Go to about:config () and set geo.enabled to false.

: if you're on Android, you'll need either an unstable version (Beta, Nightly) or a fork (Fennec from F-Droid) of Firefox to get access to that page because Mozilla decided users of the standard distribution can't be trusted with these settings.

This would make sense, thank you. Apparently Chrome has something similar?

When you are on the VPN test for these:

https://www.expressvpn.com/webrtc-leak-test

https://www.dnsleaktest.com/

http://ipv6leak.com/

if this were true then BBC would know I'm not watching from UK.

I dont want to dislike firefox, but I am starting to find new reasons to resent it. It seems like every other week there is something new I'm finding out about that gives me pause before running updates. Every new 'feature' brings me further and further away from feeling like it's a browser I can trust to be just a browser. Something has to change. Pocket, Allo, still taking the google allowance, absolutely squandering their endowments on salary, too much focus on social signaling and politics. Just be a browser, please.

I won't be going to anything chrome-like, but I do see myself spending a lot more time using and sponsoring qutebrowser, or simply passively consuming offline.

Not having some proprietary debugger thing for this to work with when you can just set location in about:config seems like the pettiest nitpick

If wanting a browser to be just a browser is petty, then I am the pettiest. If you havent tried qutebrowser yet, give it a shot. When I say just a browser, this hits it pretty close, if you ask me.

Vim mode is pretty neat. It seems like the whole app is kind of just like a python gui app wrapper around webkit? Looks like it would be pretty good if I was using linux and a tiling wm as my main thing but these days I'm pretty bound to Windows for the type of development I'm working on.

Most of my linux desktop usage these days is stuff like writing scrapers in cloud containers that need a real browser that I can control using selenium or puppeteer or whatever though, is it supporting anything like that? If this works on Windows too that would be a bonus.

I don't know if it supports that type of workflow yet, but I hope something fills that void soon. It's a very real need with a clearly defined utility.

> still taking the google allowance,

Doesn't Mozilla's revenue breakdown still show Google as the majority of their revenue, and pocket et al are efforts to diversify?

I wonder how that compares with Google Chrome relationship with Google...

But, what will you go to? Chrome is worse by any metric.

There’s always Edge if you want Chrome without the Google and want some closed source bits (for streaming or whatever).

Epiphany (aka Gnome Web) works pretty well on 99% of websites for me

qutebrowser, like i said in the comment.

Allo? I think you confused this with something else if you're referring to Google Allo chat app.

https://www.pcworld.com/article/435884/firefox-hello-is-mozi...

Chrome is about to kill add blockers and you're complaining that Firefox doesn't have a super niche feature?!

You can literally accomplish this in firefox by other means.

If you use Firefox, you can set your location in about:config without an extension:

https://security.stackexchange.com/questions/147166/how-can-...

I'm using these FF addons CanvasBlocker and Spoof Timezone to spoof UA and timezone. I checked vytal.io and it shows those addons can't fully spoof web worker method. I usually use https://browserleaks.com/javascript to test spoofing addons.

Very interesting.

Is there a risk that installing Chrome plugins makes your browser fingerprint more unique? Isn't the list of installed plugin-ins checked?

Chrome extensions can be detected by fetching their web-accessible resources. These are files inside an extension that can be accessed by web pages.

Vytal has no web-accessible resources so it can not be detected.

With Manifest V3, you an inject scripts in the "MAIN" world [1] without exposing them as web-accessible resources.

[1] https://developer.chrome.com/docs/extensions/reference/scrip...

I'm going to have to try using this to activate bank cards and add them to Google Pay while abroad. That's my one use case that VPNs have proven not to be enough for.

So I've installed it. I'm tunneling to another country. Vytal says everything is correct for country B. However the site I'm testing posting to still detects that I'm outside their country. And I can't work out how :/

Very few websites/services actually use location to test geo-restriction (especially on browser. it's more common for mobile apps).

The most common reason why you VPN didn't work is that they simply block IP ranges of common used (proxy) servers. They also can check if the IP is "Native IP" (means it's actually registered in the country that the server is in.)

I think I've worked it out. They detect VPN/proxies, where there are plenty of libraries to do so.

So I tried creating a VPS in the same city as them last night, used freakin' lynx on a terminal so sans-Javascript, and lo and behold, still detected that I wasn't in their country :/

Perhaps try a DNS leak test?

I use google DNS - surely that's mostly agnostic?

I think I've worked out how tho. They detect VPN/proxies, where there are plenty of libraries to do so.

So I tried creating a VPS in the same city as them last night, used freakin' lynx on a terminal so sans-Javascript, and lo and behold, still detected that I wasn't in their country :/

> I use google DNS - surely that's mostly agnostic?

https://developers.google.com/speed/public-dns/docs/ecs

You've also got to set you locale aswell. It's easy to see if you've set your language to say Australian English.

I have my browser set to English in a non-English country. Set your locale to what you are comfortable with reading. It doesn’t (shouldn’t) factor into things except the language the website displays. Unless you are Google, then it might just randomly pick a random language (my results flip flop between Portuguese and Dutch, despite manually changing the language back to English repeatedly).

What if I am travelling to another country physically where I don't read or write the local language? Would this affect my website access even if I'm connected via an IP inside the country?

I didn't know how extensive and interesting the chrome debugging API was until today[1]..thanks for sharing!

[1] https://developer.chrome.com/docs/extensions/mv3/messaging/

This extension takes an interesting approach to spoofing data, which is nice!

In my case, I’m interested in doing the same thing inside of Puppeteer for web scraping, unfortunately it seems like the only possible approach is similar to content scripts (for example https://github.com/berstend/puppeteer-extra/tree/master/pack...) which leads to it being easily detected. Are there any similar approaches that can be used for Puppeteer?

You can load extensions in puppeteer, also in headless with the experimental chrome mode. https://github.com/puppeteer/puppeteer/blob/main/docs/api.md...

The flags you need for headless extensions are --enable-features=UseOzonePlatform and --ozone-platform=headless, but tell puppeteer to run normally, not headless. That way it still uses full chrome but doesn't require a display server.

Great project!

However is there any features over just going to developer tools > Sensors > Location and overriding it manually?

Is it just to be able to match your IP automatically ?

I'm currently using it on brave, and there is always an info bar that pops up("Vytal" started debugging this browser session)

Is there a way to permanently dismiss this?, because it pops up with every refresh and its very annoying.

Wow, this is the first solution to getting around Bumble's geo-locking that I've seen since 2021. And it's simple too.

Great job!

In addition to this I can recommend user-agent switcher:

https://addons.mozilla.org/en-CA/firefox/addon/user-agent-sw...

The fact that the debugger API is active is almost certainly detectable. I haven't tried recently, but it's been possible in older versions - and I've yet to come across a spoofing tool that I couldn't find a way to detect.

How can you detect it?

Modern VPN usage means do not have understood the purpose of a VPN...

Using a VPN as a proxy to circumvent geographical block is reasonable to a certain extent, but call them a privacy help, when you do not own the server is ridiculous...

VPNs help with privacy when the alternative is known to be malicious, as most US ISP connections are.

So... An unknown commercial VPN hoster who happen to sell so called now "VPNs", with a siege in British Virgin Island (for instance) is not malicious while a local ISP, obliged to follow national laws you probably know is worse?

It's hard to believe for me...

If I host my VPN for instance to include some remote machines to my LAN, or as a company to offer a LAN to nomadic clients, that's a thing. If I decide to route 100% of my traffic to some servers in exotic locations where no privacy laws exists, where I probably never ever look for a local lawyer just because of lack of norms, language and costs issues, it's IMVHO a crazy choice like those who regularly buy "anti-5G radiation-absorber stickers" or "air purifier" and things like that.

My ISP might spy on me, surely they do, but we have a contract under local laws we both knows, we speak the same language, I have a local lawyer I trust etc. Using something else to circumvent eventual geo-blocks ok, but for the rest? How can I trust more an unknown third from exotic places telling in its advertisement "we care about privacy"?

Nice one! It's a pity about the tab initialisation problem, I almost always open links in new tabs but great work nonetheless.

Does geolocation need to be spoofed if I'm on a VPN? Is't geolocation detected using IP address?

Well Google Map still knows where I am when my VPN is activated. So I'd say yes, unless VPNs on mobile are less reliable than on PC

Google Maps still knows where you are on your mobile because it can still detect nearby WiFi networks and use the GNSS receiver. You would need to remove these permissions, and then it wouldn't work at all.

Modern browsers provide a location API, independent of one's IP address.

Surely this is a case of inventing something that does not to be invented ?

Surely the only correct answer is:

    1) Go to browser preferences
    2) Go to Privacy & Security
    3) "Don't allow sites to see your location" = ON

Firefox has this. Brave has this. And if you use Chrome, well, sharing your location is probably the least of your worries !

Surely this is a case of commenting something that does not to be commented ?

Check out https://vytal.io/. There are many more data points then just the geolocation api.

> Check out https://vytal.io/. There are many more data points then just the geolocation api.

I think most people would agree that your so called additional data points are worthless for the purpose that most people would be concerned about location data.

Something like timezone "location" (which basically what your vytal website is showing) is simply not granular enough to be used for nefarious purposes.

I mean, if my browser is telling someone that my "location" is EDT timezone what good is that going to do them ? Its still too much of haystack to be useful to anyone.

Let's be honest here, "location" to most people means GPS-type location (i.e. you'll find me in this house on this street). Anything more coarse than that is frankly of limited use to an adversary.

What if you're trying to hide your country lol? It also spoofs your locale and user agent. Just because its not something you care about doesn't mean its useless. Also never claimed it was going to change the world or anything. Just thought it was an interesting way to use the debugger api and that some people might find it cool.

Consider some “people who downloaded and executed ga.js from misinfo.gov.” What is the relative size of these three anonymity sets?

* browser with IP in USA but timezone in Russia

* browser with IP in USA and timezone in USA

* browser with IP in Russia with timezone in Russia

Hint: it’s the middle one. The smaller the anonymity set, the more conspicuous and therefore fingerprintable you are.

Wait until you find out about js timezone checks. It even states so in the dev's comment here...

out of the interest... are there any firefox derivations with which still the classic addons work?

Does it spoof IP location?

That's what you need a VPN for

Or a proxy server.

The idea for this extension is really cool! However I use a proxy switcher extension to connect to my vpn client on a per website basis (tldr split tunneling). Is there any way to make your extension work with this setup?

Reply on news.ycombinator.com