FINDING · DETECTION
Chinese browsers transmit GPS coordinates alongside persistent user IDs (IMEI, GAID, CUID) and client IPs to vendor servers with poor transport security; an attacker with access to this stream can trivially detect VPN use without any DPI—GPS coordinates placing a user inside China combined with a non-Chinese client IP is an unambiguous VPN-use signal. This correlation attack succeeds against VPNs with perfect traffic obfuscation because the detection side-channel is entirely outside the encrypted tunnel.
From 2025-rodriguez-revisiting — Revisiting BAT Browsers: Protecting At-Risk Populations from Surveillance, Censorship, and Targeted Attacks · §5, §6 · 2025 · Free and Open Communications on the Internet
Implications
- VPN clients targeting at-risk Chinese users should consider requesting Android DENY_LOCATION or blocking GPS-access by browser processes at the OS level, since GPS-to-IP correlation provides a VPN detection path that bypasses all transport-layer obfuscation.
- Circumvention tools cannot rely on traffic obfuscation alone to protect users who run Chinese browsers; operator documentation must explicitly address the GPS-plus-IP correlation risk as a separate threat model.
Tags
Extracted by claude-sonnet-4-6 — review before relying.