The address and what follows it

Changing where a connection comes out is the easy half. The hard half is that a site reads the country from that address and compares it with the clock and the language the browser reports, so the eight usual approaches are set here on that axis.

What an exit address decides

An exit address is not one answer. A site reads the address, the country looked up from it, and the time and language the browser volunteers on its own.

An address with no clock and no language behind it is worse than no address at all. A German exit that reports Tokyo time describes a person nobody has met.

The address
Where the connection comes out, and the only part a proxy changes.
The country read from it
A site looks it up in public registries, and nobody asks you.
The clock
The time zone your browser reports, which a site checks against that country.
The language list
What the browser asks pages for, sent on every request.

Eight ways on one axis

Rows are the approaches, columns the questions this axis asks. A dash means the approach does not do that thing, not that it does it badly.

The last row is ours, and you can check every cell in it: each one comes from code you can open, named at the bottom of the page.

	How the exit is set	Reach of one setting	Clock and language follow	Separate exits at once
Ordinary browser, as it is	Through the system settings	Every tab at once	–	One
Incognito window	Whatever the browser around it uses	Every tab at once	–	One
Browser profiles or containers	Shared with the browser around them	Every tab at once	–	One
Spoofing extension	Through the browser's own proxy setting	Every tab at once	Declared in the page, after the start	One
VPN	One tunnel for the machine	Every application on the machine	–	One at a time
Virtual machine per account	Set inside the guest system	That guest system	By hand, inside the guest	One per machine you run
Separate device per account	Its own line or SIM	That device	By hand, on the device	One per device
Browser with the engine patched	A proxy attached to the profile	That profile alone	For countries in its list	One per open profile

What country a site will see

You see the country a platform will see: the app asks for it through the proxy itself rather than from your own connection. Asking any other way would measure the wrong machine.

There are several geolocation services, and the profile takes the first answer it can read. That is a first answer rather than several services agreeing, and the profile's clock follows it.

Through the proxy
The question leaves by the route the profile is about to use.
Over an encrypted connection
A plain request could be rewritten on the way and name a false country.
Several services
One busy service answering with a refusal must not decide an identity.
Asked once per address
The profile keeps the answer and asks again only when the address changes.

The proxies screen in ARMANOS: five saved proxies from different countries, each with buttons to test it, edit it and list its profiles — The name you gave a proxy, its address and how many profiles sit on it are all in the row. The test beside it goes through that proxy itself.

One rule for every scheme

One proxy address covers all of a profile's traffic rather than one kind of it. A rule written for plain traffic alone lets secure traffic out directly, and that is nearly everything you do.

A proxy that cannot be applied stops the profile from starting. Leaving through your own address while the screen says otherwise is worse than not leaving at all.

One address, all traffic
The same address applies to plain and to secure traffic.
No password on the command line
No side route around it
A profile makes no direct peer connections outside the proxy.
An exit over your own server
Your profile does not start until the tunnel is up, and if the tunnel fails you get a refusal.

What the clock is built from

From the exit country a profile takes a time zone and a language list, and the language of that country stands first in it.

A few large countries have more than one zone, and there each of your profiles gets its own. A hundred profiles on American addresses would otherwise share one clock and link themselves by it.

When the country stays unknown

If the country cannot be read from the proxy, the app tells you instead of starting the profile quietly with a clock that does not match. The app does not keep that answer and asks again at the next start. A country the app does not know is the quieter case: you get no warning, and the clock stays the one the profile's fingerprint drew.

What this comparison does not claim

It does not claim that an exit address hides who you are. It moves where the connection appears to come from, and what you type and post stays yours.
It does not come with addresses. Until you attach a proxy, a profile leaves through your own connection.
It does not claim the clock follows the city or covers every country. The zone comes from the country, and outside the ones the app knows a profile keeps its fingerprint clock.
It does not claim the country can never be wrong. It comes from outside services, and a service that answers wrongly makes the clock wrong too.
It does not measure other tools. The rows say what each kind of approach can do by its nature, and only the last row comes from code we can open.

How to check

Each line names the file that decides the behaviour and, where there is one, the stand that fails the build when it stops being true.

The exit country is asked through the proxy itself, encrypted, services in turn: apps/desktop/src/lib/exitGeo.js · apps/desktop/test/exit-geo.js
One proxy rule covers every scheme, plain and secure alike: apps/desktop/src/main/main.js · apps/desktop/test/proxy-covers-https.js
The clock and the language list are built from the exit country: packages/shared/src/index.js · apps/desktop/test/fingerprint-card-matches.js
An exit over your own server raises a tunnel first, and a failed tunnel refuses the launch: apps/desktop/src/lib/sshTunnel.js · apps/desktop/test/выход-по-ssh.js

Questions

Why ask the country through the proxy instead of from a server?: Because the question is what the world sees at the far end of that route. A server of ours would report the country of our own machine.
What happens when two services disagree?: They are asked in turn and the profile takes the first answer it can read, so the later ones are never asked. An answer with no country does not count.
Does the proxy cover secure traffic as well?: Yes. The same address covers a profile's plain and secure traffic alike, and what holds that true is named below.
Does my whole machine go through it?: No. Only that profile takes that route, so your mail client and your other windows keep your own connection. For the whole machine, that is what a VPN is for.

What your browser reveals about its route

The leak check reads what leaves your browser past the proxy and sends nothing anywhere.

Download ARMANOS Open the leak check