Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If you're using a vpn, is it possible for a 3rd party website to use javascript or any other means to extract your real IP address? Or is there no way for them to know your real IP as long as you're on the vpn?

share|improve this question

JavaScript by itself won't allow them to enumerate all your network interfaces, only query the IP that your system is connecting from. Any website you connect to can tell the IP address you're connecting from. In the case of a VPN, you're "connecting from" the IP address of the VPN, not your own IP.

In this scenario, there are two "threat agents":

  • The website you are connecting to.
  • The VPN server you are passing information through.

Ways for the Website to expose you without the help of the VPN server

If you agree to run native code or .NET/Java code with full trust, such as:

  • An ActiveX applet (I'm sure of this one)
  • A Java applet (I'm sure of this one)
  • A .NET XBAP (I'm pretty sure of this one)
  • Flash, maybe? (Someone confirm)
  • Silverlight, maybe? (Someone confirm)
  • Any other browser plugins that allow arbitrary native code or robust runtime environments

The above listed environments allow the program to query details about the native operating environment, which includes a list of all the network cards / interfaces. One of those interfaces would be your local ethernet or wireless interface, which would (at least) contain your Private NAT IP, but may or may not contain your Public IP.

Ways for the VPN server to expose you (intentionally or accidentally)

The VPN itself could be configured to inject a header into HTTP requests giving away your IP address, but that behavior would be fairly unusual for a VPN. This is typically only done by proxies, which are not to be confused with VPNs. Still, an arbitrary, untrusted VPN (one that you do not control, and whose owner you don't fully trust) could seemingly at-will decide that it wants to give away your IP address, and just do it. So you need to trust that the software is not going to do that, and that the owner of the machine isn't going to modify the software to make it do that.

The way you asked the problem is really an information-theoretic problem. We can understand this on simple human interaction terms:

  • Jack wants to send message M to Colt.
  • Jack does not want Colt to be able to know that M originated from Jack.
  • Jack gives M to Sally, and asks her to send the message to Colt.
  • Sally knows that Jack is the origin of M.

At this point, it is entirely up to Sally, an arbitrary human actor, to decide what they want to do with the following information:

  • The message M
  • The identity of Colt
  • The identity of Jack
  • The fact that Jack originated M
  • The fact that Jack requested that M be sent to Colt

Sally conceivably may:

  • Send M to Jack's worst enemy
  • Send the fact that Jack originated M to Jack's worst enemy
  • Disclose all of the information Sally has obtained to the general public
  • Send M to Colt but lie and say that the message originated from someone else

Whether or not VPN software is by default configured to behave a certain way is a very different question from "is it possible ...".

The short answer is yes, it is possible.

Unless you truly trust the owner/operator of the VPN server, and all of the software running on it, there is always the possibility. And if the owner/operator is a stranger and you have no means of analyzing the software running on the box, you definitely have no reason to suspect that your identity will be protected.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .