> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.

If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.

If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.

VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.

https://www.usenix.org/legacy/event/nsdi07/tech/full_papers/...