3

I would like to fake my location to one specific website, but it doesn't work. I tried two methods:

  1. I installed TunnelBear VPN and I allowed GhostBear and VigilantBear options. I installed Brave browser and logged in a website, but my real location was recognized.
    When I checked my location through iplocation, I got VPN's location.

  2. I installed Tor browser and based on this tutorial I set only specific countries to fake my location. When I logged in the website it says that my current timezone is utc +00:00 - undefined, so I am able to hide my location, but I am not able to fake it.
    When I checked my location through iplocation, I got tor's node location.

If I try Tor browser without Tor network and without using VPN, I got the same result as using Tor browser with Tor network. The website determines my current timezone utc +00:00 - undefined. There is something what other browsers share with the website, even if I clear browsing data, the cache, and use incognito mode.

Do you know any VPN service or whatever method how I can really fake my location?

12
  • 1
    Do you know how the website was getting your location? For example, phone browsers in particular will allow sending your 'Location Services' location (e.g. GPS) to the website. If your browser is voluntary providing your location within the website, VPN does nothing. Tor browser specifically does not reply to such requests and/or zeros out a lot of these fields, so the website cannot use your browser location and must fall back to IP.
    – Andy
    Jun 12, 2019 at 19:42
  • 1
    What platform are you on? Make sure to do each test with a completely clean browser (clear all cookies, databases, caches, and other stored state). It's possible the site is using device fingerprinting to identify you and link you back to your original ISP location. VPN and Tor will be a red flag to any server that wants to protect againat geo-shifting. In Tor, if you select an exit node in some country, then IP-geolocation will probably detect that country. Not sure why timezone wouldn't match.
    – pseudon
    Jun 13, 2019 at 16:45
  • 2
    Is there a particular reason you are using brave? There are privacy concious browsers which, like brave, tend to be Firefox derivatives. Brave seems like a wierd choice for a privacy centric browser through since its main thing is removing the native adds from a website and replacing them with other targeted advertising. In other words, it sells your browsing habits to other advertising companies. Are you sure that is what you want? You might consider using tor browser without tor network. superuser.com/questions/1117383
    – Andy
    Jun 14, 2019 at 8:49
  • 1
    Try a virtual machine (virtualbox) with some other OS and set a proxy before going to visit that site... It is possible that the site already put its cookies (in a previous visit). Start with Linux, with a proxy or eventually with a VPN. (You can find ready to be used virtual machines iso in many places...)
    – Hastur
    Jun 17, 2019 at 15:16
  • 1
    @Matt Set a proxy from that specific country or the VPN. The problem may reside in the signatures that site may have already acquired from your browser (cookies, ID, javascript function that can read something...). A new VM with a virgin system and cache can overcome it. The use of a proxy/VPN can set your exit-point in the desired country. Moreover you can save a snapshot of the VM and make different attempt, starting from the same point. Let me know.
    – Hastur
    Jun 18, 2019 at 13:53

4 Answers 4

3
+50

Causes

It is unclear from where the site takes that information (you should follow line by line the code of the pages your browser calls when you visit that site).
The problem may reside in the signatures that the site may have already acquired from your browser (cookies, ID, javascript function that can read something more than cookies...).

Overkill solution: Use a Virtual Machine (Virtualbox)

A new VM (e.g. Virtualbox) with a virgin system (e.g. Linux) and cache can overcome it.
The use of a proxy/VPN can set your exit-point in the desired country.
Moreover you can save a snapshot of the VM and make different attempt, starting from the same point.

Notes:

  • set a proxy (or the VPN) before the first visit to that site...
    It is possible that the site already put its cookies (in a previous visit) or that it reads cookies of third parties: so set proxy or VPN as early as possible.
  • You may download virtual machine images ready to be used from many location on the net.

The OP specific solution

I installed ubuntu in virtualbox. Then I installed chrome with tunnelbear extension. When I visited the website, it recognized vpn's location.

4

There are many ways that JavaScript web-app can geo-track the browser, and even more ways for an add-on installed in the browser. One is basically dependent on everyone playing by the rules with no unpublished hacks used by the website. Below are some points about this subject, although it is too vast for the list to be exhaustive or even bullet-proof, and using only one of the below methods may not be enough.

VPN

The IP is one of the major mechanisms for geo-tracking. It is important to choose a VPN that does not leak of any kind and also ensure that your DNS is served through the VPN (see IPLeak.net and many others).

ExpressVPN (commercial) has a browser extension that will automatically change Firefox or Chrome geolocation data to match the connected VPN location, as does TunnelBear VPN and others.

WebRTC is a tracking feature that is usually disabled in browsers, but better check to ensure that it is off (see article).

Cookies and add-ons

This is another mechanism for tracking. Some browsers have a private mode, such as Chrome Incognito and Firefox Safe mode, that solve this problem.

Google Chrome Browser

To fake geolocation, one can use an add-on such as Manual Geolocation, or do it yourself as follows:

  • Open Chrome Developer Tools

  • In the Console tab, click on the "3 Vertical dot" menu and then More Tools > Sensors

  • At the bottom of the panel, go to Sensors again, and set Custom Location to one of the presets or the GPS geo-coordinates (Latitude & Longitude)

Firefox browser

The location Guard add-on can change the geographic location to a desired value. After installation, it can be accessed via the Tools menu.

To manually change the location, in about:config look for the setting geo.wifi.uri and enter a specific longitude and latitude value. An example value is: data:application/json,{"location": {"lat": 40.7590, "lng": -73.9845}, "accuracy": 27000.0}. For more information on this format see link.

1
  • 1
    Thanks for such an extensive response. I checked ip and dns leaking and didn't find any issues. I disabled WebRTC, which was enabled before. It didn't help. I changed geolocation manually and always use incognito and safe mode. It is interesting there isn't a tool or browser extension which would help me out to figure out what is leaking :D
    – Matt
    Jun 17, 2019 at 7:45
3

A website you visit with a browser can determine your location through several means:

  1. Geolocation API (if allowed by your system and browser settings), which will use GPS, cell tower, Wi-Fi, or IP Geolocation to provide a location.

  2. IP Geolocation (separate from the Geolocation API), which uses your IP address to estimate a location. Accuracy depends on many factors, and may be anything from country-level to very accurate (for example, a relatively static IP assignment that has been previously associated with a specific location). Most likely is city level accuracy.

You can, as you discovered, shift your apparent location by changing the IP address you appear to come from. Keep in mind that your browser may still be sending headers to indicate your preferred language and other characteristics that could be interpreted as inconsistent with your IP address.

To spoof your location would be very difficult. You would probably need to combine several techniques, including a custom browser that fakes Geolocation API responses (and your IP address must be consistent with that faked location).

But given a sufficiently sophisticated server, any privacy hygiene issues with your browser stored state (e.g., cookies) or browser fingerprint could easily betray your attempts to shift or spoof your location.

2
  • Thanks for your response. Seems like spoofing location is more difficult than I thought. I am on OSX and I disabled System Preferences -> Security & Privacy -> Location Services. I cleared browsing data and used incognito mode in browsers, but it didn't help.
    – Matt
    Jun 14, 2019 at 9:07
  • 1
    I tried Tor browser without Tor network and without VPN and I got the same result as using Tor browser with Tor network. The website determines that my current timezone is utc +00:00 - undefined. There is something what others browsers share with the website, but I have no idea what.
    – Matt
    Jun 14, 2019 at 9:41
0

If are serious about spoofing and not just privacy, I believe the next step after looking at custom browsers is to look at hacker's tools. Packet manipulation tools like burpsuite may be your friend. Not only can you see where your data leak is coming from, you can draw up rules to automatically fudge the location fields in outgoing packets.

1
  • I will take a look at burpsuite. Thanks.
    – Matt
    Jun 17, 2019 at 13:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .