
Most Internet anonymity software leaks users’ details - Libertatea
http://www.qmul.ac.uk/media/news/items/se/158459.html
======
Matt3o12_
I can't agree with many facts in that article:

> "[VPNs are] used by around 20 per cent of European internet users they
> encrypt users’"

I think it is more like 2%. I don't know anyone but me who uses a VPN. I'd
even say that if I picked 100 people I know, less then 20% know what a VPN is.

Furthermore, the article makes IPv6 sound bad. If I didn't know what IPv6 and
VPNs are, I might think it IPv6 is bad, too. I'm also interested in knowing
which VPN softwares they tested. While I'm certain that old VPN Softwares leak
IPv6 IPs, I can't say that for all VPN softwares I use: OpenVPN (on Linux and
Tunnelblick on Mac) and Mac's built-in VPN software (which supports L2TP over
IPsec and PPTP). It is really a shame, though, that my VPN provider does not
support IPv6, yet.

The only thing that really leaks my real IP is WebRTC. Thanks to WebRTC,
everyone can see my real IP address and I can't disable in google chrome. If
you want to check what information your VPN is leaking, checkout:
[https://ipleak.net/](https://ipleak.net/)

~~~
learnstats2
> I'd even say that if I picked 100 people I know, less then 20% know what a
> VPN is.

I think you significantly underestimate VPN usage. Many jobs, including large
public service employers, require connection to a VPN.

~~~
dogma1138
That's to access corporate resources, the article was specifically talking
about general purpose VPN providers which people use to avoid various
restrictions.

So yeah the chance that 20% of internet users in the EU use some sort of a
privacy oriented VPN service is nill.

IPv6 has always had many issues, it's entire auto discovery mechanism is a big
big security gap.

~~~
ikeboy
See [http://www.statista.com/statistics/301212/vpn-proxy-usage-
ag...](http://www.statista.com/statistics/301212/vpn-proxy-usage-age/) and
[http://digiday.com/publishers/vpn-hide-ip-address-distort-
an...](http://digiday.com/publishers/vpn-hide-ip-address-distort-analytics/)

------
higherpurpose
Apparently the DNS hijacking issue is a little outdated (applies up to OpenVPN
2.0.9). At least with AirVPN it seems you can prevent IPv6 address leaking
with the Network Lock feature.

[https://airvpn.org/topic/14231-ipv6-leakage-and-dns-
hijackin...](https://airvpn.org/topic/14231-ipv6-leakage-and-dns-
hijacking/#entry27633)

~~~
dogma1138
It's really doesn't matter which VPN protocol or client you use its more about
how the OS responds to IPv6 router and other service discovery requests.

Some OS's will grant IPv6 priority routing, and virtually all of them will
issue DNS requests on both IPv6 and IPv4 if a DNS server is also configured on
the IPv6 interface.

The DNS hijacking happens because a DNS request sent over IPv6 to a DNS server
doesn't have to be for a AAAA entry, you can request simple A entries with
DNS6. Since the attacker is on the same network his replies to your DNS
requests would usually arrive much faster unless the entry is cached so they
can return anything they want and they'll get their first :)

In that link you've posted the OP basically suggests that AirVPN client (which
is i assume an OpenVPN preconfigured client) will configure the IPv6 address
settings on the host with either real or dummy IPv6 routes to mitigate against
these attacks.

------
Aoyagi
Speaking of which, have there been any checks of Telegram or Tox regarding
leaking and such?

~~~
zz1
Of course, Telegram is just plain awful, and rather than a leak, it is a free
flow.

------
worklogin
I once posted to /r/tor (or /r/onions, I forget) that the Tor Browser Bundle
leaks the current browser window size ( instead of providing a universal
value) thus increasing uniqueness on tools like Panopticlick. Firefox, for the
same value, provides screen resolution, not window resolution.

~~~
kiiski
It seems like the Tor Browser at least pops up a message saying you should
leave the window to its original size when you maximize it. It still lets you
do it.

