Disable VPN while browsing casual or leave running?
Disable VPN while browsing casual or leave running?
Hey guys n gurls, I was wondering if it is smart to disable my VPN connection for casual browsing.
Reasons: when having VPN constantly running it may be possible to track me via browser fingerprinting.
Szenario: the connection coming from the VPN which hypothetically downloaded a torrent, tries to watch capitalist propaganda while living in China, etc.pp has this screen ratio, this locale, this addons etc. And (more important) the YouTube login cookie we know belongs to this physical person/telephone number etc.
So I am wondering if I should only use the VPN when "needing" it (read articles not available in country, Netflix, read information government doesn't like, things like that.) Or if I'm missing something here and I could obscure my causal day to day browsing as well without decreasing the security of the VPN.
For reference, the VPN doesn't log anything (for more than a day) to my knowledge
EDIT: From what I understand from the comments: switching the VPN has little to no impact on widely used tracking and if at all makes it easier to corelate data. People emphasize the general lack of full privacy if you are wanted by entities willing to spend enough resources. But for the general need of privacy in normal usecases it makes more sense to just leave the VPN running.
tldr; no, if you trust your vpn more than your ISP always use it, as any hit to fingerprinting is menial.
it really can't hurt much to always be using it. any fingerprinting metric it would give is outweighed by the hiding of your IP behind the proxy. this is the #1 unique identifier that is tied back to people/locations.
the other fingerprinting metrics also are still exposed anyway & could probably be linked back to "you" regardless of your IP changing if they wanted too.
if you are worried about fingerprinting look into some projects like mullvad, librewolf, or even tor. clearing cookies on quit &/or having a separate browser for permenant logins/tokens to live in is also a good mitigation technique.
Thanks for the detailed response. I'm sure my IP is most relevant in tracking me, but if I'm tracked while visiting Lemmy/YouTube it would do no harm, while correlating my YouTube activity with my e.g. me reading websites the government doesn't like would do harm.
I use mullvad, and previously read using tor through a VPN doesn't really make sense. I have Firefox set to not save cookies, but I have made an exception for YouTube as it is to troublesome to log in with 2fa all the time.
My thought was that it may be easier to match up the fingerprint of @somelemmyuser accessing lemmy with the fingerprint of @somelemmyuser downloading capitalist propaganda while living in China if they come from the same VPN in a similar timeframe, while it would be harder to match the fingerprint of @somelemmyuser acsessing Lemmy from an normal ISP to the fingerprint of @somelemmyuser accsessing capitalist propaganda from a VPN, as you would need both datasets to find matches.
And since me accessing Lemmy is not a problem but my lemmy account could be tracked back to me as a physical person, it could be smart to not do it with the same VPN.
ahhh I see what you mean.
your thoughts on spacing out your connections & isolating is smart. unfortunately if you connect from the same device & browser any government agency or dedicated company with a big enough dataset (google, meta, etc.) would still be able to link you regardless of you IP by browser fingerprint alone. this does make YouTube more specifically being linked to your exact browser fingerprint porblamatic in a high stakes situation. As it, as you said is linked to your identity.
for lower level tracking changing IP regularly is effective. however, instead of switching to your local IP it would be more privacy conscious to just switch to a different VPN server.
unfortunately if you are genuinely worried about government level surveillance or the likes u enter into territory where VPNs often no longer cut it (or at least can't truly be trusted too) as they are centralized & can be forced to make exceptions for law enforcement. traffic analysis is also easier, which makes time correlation deanonimization a more realistic risk when talking about government agencies specifically.
the tor + vpn debate is one that lots of people argue & is excedingly complicated. tor is generally more than enough, unless you are wanted by INTERPOL haha. if you are genuinely worried about suppressive government or world powers targeting you look further into tor, & do not connect directly to your ISP at all as that data is essentially up for grabs to local authorities (depending on locale).
for you specifically I would consider doing your more sensitive tasks in the tor browser without the VPN & then having your normal browser always on the VPN so they would be more difficult to correlate. anything torrent related is low enough stakes that I would imagine just about any proxy would suffice. hope this was helpful 🙏.
Never disable it. Actually, setup a firewall so no apps have internet access in-case the VPN is down.
For android:
- open settings
- search for always on VPN (or open it manually, search is just easier)
- enable it
- and enable block access without VPN
So now your device will nag if you disable the VPN and will refuse internet access for apps outside the specified VPN profile
Example image:
Timing attacks are a thing and behavior can be correlated by metadata and situational considerations, e.g. Bob only uses his VPN at night, and only for 21 minutes on average. Jane uses her VPN from roughly 830am to 515pm M-F. What do those patterns mean?
But so long as it works and the costs are low, use the VPN constantly. And always check for leaks.
Any suggestions about checking leaks etc? I have done this one check, but I'm not that deep in the matter to know if its enough.
So you say to keep it running - any (technical) reasoning or just that you think my YouTube connection exiting the vpn and the connection to the website the government doesn't like exiting the VPN can not be correlated that easy?
If you use it for everything, when you use it ceases to be useful information for data gatherers.
It’s why companies have data retention policies. That way they can’t be accused of intentionally destroying data to hide things, because they destroy ALL data like that.
I would just leave it running all the time as it does give a privacy boost by masking ur approximate location and not letting your ISP spy on you. If you are going to do things like torrenting or visiting websites the government won't like, at LEAST use a different browser that is hardened (let's say you use basic firefox for regular browsing, use Mullvad browser or something instead for that specific task), or just straight up use TOR if what you are trying to do won't require that fast of internet speeds. If you are solely worried about the VPN IP address, you can just switch to a different server to a different country.
It won't make any difference. It actually could potentially make you more fingerprintable, since your IP adress is no longer shared with many other people depending on the VPN you're using, etc.
At the end of the day, VPNs are not necessary to be not tracked, since your IP adress changes regulary, but it can be helpful in some scenario's and it's not harmful either, aslong your provider is not a bad actor.
Personally I'd rather my ISP see more of my internet activity as I think they are less likely to be interested in using/selling as much of my data (or be compromised in some way) as a VPN company. But I could be wrong.
I've never had internet service where my IP changes. I understand this is common in some places, but I've had a static IP assigned by ISP everywhere I've ever lived.
Oh okay, never heard of this since it's very unsual to give static IPs to people, especially since IPv4 adresses are very limited in their amount.
that's not how it works.
your vpn doesn't do anything to mitigate broswer fingerprinting. websites use browser fingerprinting to identify a unique browser no matter the ip its connecting from. when i connect through mullvad's french server, it identifies my browser just like when i connect through any other server.
most of the time those sites even clock that i'm connecting through a vpn.
a computer that is connected to some vpn and downloads a torrent while also visiting a website that fingerprints their browser will not have the two conflated unless the attacker can match traffic coming out of the vpn and traffic going into the computer.
that information wouldn't be useful to an attacker unless they also had access to the website that fingerprinted the browser and were part of the torrent swarm so they could actually say yes, browser 12345 and user 34567 downloading The_Mummy_CrAcK_DeNuVo.mp4 are the same person and they were at this ip that corresponds to this router at this physical location and when we confiscate their computer we can verify their browser has the fingerprint, open and shut case, book em' dano.
if you disconnect from your vpn intermittently it actually makes those checks easier because then the attacker can say "look, browser 12345 is coming from both the french mullvad node and from this little coffee shop in taipei! get em!"
a single vpn proxy can't protect you from a hypothetical hostile whole ass internet.
Thanks, that makes sense.
not sure if relevant, but you can use this for info
A favored test by the AirVPN people. Gives a decent picture of your print. Thing is, they can pick all the scree resolutions and browser types they like, but it only does good with a location
Use safing SPN with their portmaster app, then you can set it on/off per app, or even per url.