As governments and companies around the world seem to be on a bit of an internet censorship binge, many people are turning to VPNs (Virtual Private Networks) to get around these restrictions—only to be caught out!
So how, if VPNs are supposed to hide your identity and location, do these systems seem to know you’re using one? It turns out that the way VPNs operate may not be all that clandestine. While VPNs are generally good at obscuring your identity and location, they aren’t good at hiding the fact that you’re using a VPN in the first place.
Your IP Address Gives It Away
Wait, doesn’t a VPN hide your IP address? Well, yes it does, but the VPN server you’re using still has an IP address of its own. You can’t access the internet without an IP address, and while your real IP address is obscured from the web when you work through a VPN, the VPN’s own IP can tell a server a lot.
For one thing, VPNs tend to use shared pools of IP addresses. The server that’s forwarding your traffic to the net is being used by multiple people at the same time. Which means that a long list of people are accessing the web using the same IP address, which is suspicious.
Over time, web servers and security companies that sell server security services build up lists of known VPN IP addresses. Which is to say, that if you access a site from one of these banned IPs, you’ll get a “VPN detected” message. Of course, the VPN companies don’t use the same IP addresses forever, and innocent people get caught up in this trap when their dynamic IPs happen to cycle into an old banned one.
That said, it’s a pretty effective way to block most VPN traffic if you don’t want it. The only effective countermeasure here is to use a VPN with a unique IP address. Some VPN services offer a more expensive option where you get a dedicated IP address for your VPN account only. In this case no one can tell the difference between someone who is really in the target location and a VPN. The only downside here is that the subscription is more expensive, but if you want to hide that you’re using a VPN, this is the biggest and most important step.
Your Browser Isn’t as Private as You Think
The other big privacy issue isn’t something the VPN service can help you with. Your own browser can give you away, because there’s certain information that a web server can get from your browser and that information can conflict with the location you’re supposedly accessing a site from. Which makes it relatively simple to block you if the point is to circumvent a geographical restriction.
If you’re, for example, accessing a site from the US according to the VPN’s server location, but your computer’s regional settings contradict that, it’s a potential sign you’re using a VPN. Sites can also check your cookies for information that shows where your real location is likely. This is most effective if you’re using a service where you have to log in, because if you logged in without a VPN in a previous session, that’s pretty much a clue that you’re using a VPN if the two locations don’t match and happened within a short time.
There’s also the larger issue of browser fingerprinting. This is where a site can link a unique ID to a specific browser because of the specific mix of system specs, extensions, and other aspects of that browser and that computer. To get around this, you need to use a privacy-focused browser like Tor or Brave Browser. You can also use extensions like Privacy Badger.
Leaks and Misconfigurations Expose You
To be honest, a VPN is a pretty thin shield as far as privacy protection goes, and just one small misconfiguration in your setup can blow your cover. A common way for this to happen is a “DNS leak”. The Domain Name System (DNS) is basically like the phone book of the internet (remember those?).
When you type in a web address, your browser will ask a DNS server what IP address that web site address represents. The DNS server returns the IP address and your browser can connect to the server in question. The thing is, if your browser asks your local DNS (such as provided by the ISP) then the website in question can see you’ve just requested an IP from a DNS server not in the same region as the VPN!
There’s also the WebRTC (Web Real-Time Communication) which can bypass a VPN completely to allow for a direct connection between your browser and a web service. This is a popular method for anything real-time like video chats, but can also be used for file transfers, online gaming, and so on. Firefox, Google Chrome, Opera, and Microsoft Edge tend to default to WebRTC when available, so they can be vulnerable to these sorts of leaks.
Some VPN providers like ExpressVPN let you detect and block WebRTC leaks using its WebRTC Leak Test, but you can always disable it in your browser. Remember that this is a browser-level feature, so you can simply have a specific browser with WebRTC turned off that you use alongside your VPN.
The last configuration issue is in fact the VPN’s responsibility. Most good VPNs offer a “killswitch” which automatically blocks your connection if it detects that the VPN server has dropped the connection. This is a lifesaver when it works, but if there’s something wrong with this feature then the VPN itself can expose you if the connection goes down for some reason.
Your Behavior Doesn’t Match Your Location
I’ve alluded to this above, but even if you use a VPN, the actual things you do on the web can give you away:
- Rapid IP cycling or sudden physically impossible location changes.
- Language and search patterns, such as using English when supposedly browsing in Japan or Europe.
- Having a payment method from a different region. In fact, some services simply don’t allow payment from outside the authorized location.
- The same device seems to hop from one location to another.
Using a VPN can definitely help hide your location and identity, but it’s just one part of the puzzle, and a pretty weak one at that. At the very least, anyone truly serious about detecting VPN use can probably do it, so don’t bank on VPN technology getting you around hurdles where VPNs themselves are banned.
Ultimately there’s no such thing as a foolproof way to hide your identity or location while on the web. Just different levels of probability that you’ll be exposed.
