Shopping Over AirVPN? (US)

[McFly 3]

What's your experience?  I've found it almost impossible to get most shopping sites to accept orders I place while using AirVPN. 

If I establish a good ongoing relationship, some sites whitelist me, but for others it's a continuous problem. 

I suspect it has a substantial amount to do with AirVPN having no servers located near me.  Closest is Chicago, which is ~300 mi away (about 500km).

 

[nexsteppe 24]

I bank and purchase supplies over VPN all the time, very rarely any difficulty.
I think the key is probably continuity: Stick to using some vanilla browser config with the same VPN node (preferrably within your country) for your shopping.  In my experience, changes in browser config trip alerts more often than VPN use does.  Some privacy-friendly tweaks (e.g., changing referer policy) might get your purchase undeservedly flagged because your browser's behaviour replicates that of bots or headless browser configs, and tend to break sites anyway.
If you're concerned about connecting your shopping behaviour with your other browsing, you'll have to take extra steps apart from just switching browsers and VPN nodes.  Browser fingerprinting is pernicious stuff.
 

[McFly 3]

It's good to see someone is making it work, thanks for replying.  I'm afraid your experience doesn't line up with mine though.

I always use AirVPN nodes within my country (USA), but the closest nodes to my shipping address are ~300 miles away.  Using different nodes doesn't seem to affect my success rate.  I don't tend to shop at the same places much (I don't even have an Amazon account).  Those places I shop at regularly are generally not a problem, though sometimes their entire site will block AirVPN.  (Looking at you, Lowe's)

I normally use several browser extensions to protect my privacy - Ublock Origin, Cookie Autodelete, and Firefox Containers.  One container is "Shopping", which is used only for that purpose and purges cookies and site data when the last Shopping tab is closed.   Sometimes when shopping I will use a private window, which has no extensions.  Doing so while still using AirVPN solves some problems, but less than half. 

Using my extensions but disconnecting from AirVPN solves about 65% of problems.  Using an extension free instance of Firefox without AirVPN solves ~90% of problems, but of course hurts my privacy substantially. 

I suspect the fact that I use both Firefox and Linux makes the user agent string very unique and similar to bots.

Thanks again for the input!

[nexsteppe 24]

I also use Linux, but switched to ungoogled-chromium (with just uBlock Origin and Cookie AutoDelete) a couple years back, so that be another variable here.  I might recommend giving that a try, as hostility to non-Chrome/Chromium browsers is definitely a thing.
When I was still using Firefox, I did keep a separate profile spare of extensions apart from uBO (just wiping all cache and site data when browser was closed), but this was before Containers were really a thing.  It sounds like you're probably doing everything right here, but it still isn't enough.
Like you, I also do not find shopping "in the clear" acceptable.  Privacy partly aside, using VPN for bank and shopping has been a practical benefit for me when travelling, fewer flags seemed to be raised since browser and IP I access site from is generally the same no matter where I actually am.  I hope you find out how to have much the same!

[McFly 3]

7 hours ago, nexsteppe said:

hostility to non-Chrome/Chromium browsers is definitely a thing.

Boy do I know that. There are government services around here which can't be accessed using Firefox. 😡

I haven't checked out ungoogled-chromium in a while. Last I checked, updating was a pain, but it looks like they have a repo now which should auto-update. Though it seems if you want support for video codecs (and maybe some other proprietary stuff), you have to build from source. True?

Maybe I'll try making ungoogled-chromium my shopping browser.

Thanks for the suggestion!

[nexsteppe 24]

On 12/2/2022 at 10:40 PM, McFly said:

Though it seems if you want support for video codecs (and maybe some other proprietary stuff), you have to build from source.  True? 

I'll admit I'm not clear on the landscape, since afaik upstream ungoogled-chromium no longer patches them out and the packages for my distro include them.  Other package maintainers (e.g., Debian and Fedora) did (do?) patch out the proprietary codecs, however.
Regarding updates, I tend to lag a bit and only keep a casual eye out for vulnerabilities I should really update for.  If you do this, too, running the browser with  --js-flags='--jitless' is recommended and shouldn't make any trouble with typical bank and shopping sites.

[McFly 3]

I'm 110% clueless on slackware, I'm afraid.  I use a motley collection of Ubuntu, Linux Mint and Fedora on my machines. 

It looks like the Debian packages from the ungoogled-software folks are no longer maintained.  The Fedora packages don't say they're unmaintained, but the Fedora build is now eight months old and references Fedora 35 which is two versions behind current (I'm running Fedora 37)  Looks like openSUSE are the folks maintaining the builds.

I assume the --js-flags='--jitless'  command is something you add to the launcher? 

Hrmm... So much IT work...

Thanks again for the discussion. 

[OpenSourcerer 1435]

If you want a CEF-based browser but don't want to build 40000+ source files, as is the case with Chromium, have a look at Falkon.

[nexsteppe 24]

On 12/7/2022 at 2:45 PM, McFly said:

I'm 110% clueless on slackware, I'm afraid.  I use a motley collection of Ubuntu, Linux Mint and Fedora on my machines. 

It looks like the Debian packages from the ungoogled-software folks are no longer maintained.  The Fedora packages don't say they're unmaintained, but the Fedora build is now eight months old and references Fedora 35 which is two versions behind current (I'm running Fedora 37)  Looks like openSUSE are the folks maintaining the builds.

I assume the --js-flags='--jitless'  command is something you add to the launcher? 

Hrmm... So much IT work...

Thanks again for the discussion. 

I can't honestly recommend Slackware unless that proverbial shoe fits you well.  I just did not realize until this thread how spoiled I was to have regularly updated builds of ungoogled-chromium specifically for my distro, and wasn't able to respond properly until I investigated the situation for other distros.  (Sorry!)
Are you opposed to using Flathub?  I polled some users of Pop!_OS and Ubuntu who had good results using Eloston's Flatpak builds, which seem to be stable and — more importantly — actively maintained/updated and rather painless to deploy.
Yes, a flag for disabling JIT is not exposed (yet?) in chrome://flags (the rough analog to Firefox's about:config), so you'd add arguments like these to your launcher shortcut.  You can do the same for WebGL and other features as it suits you.
That would leave the matter of extensions.  Ungoogled-chromium does not support Chrome Web Store by default (a good thing imo), although you can install this if you want to.  Unlike Firefox, loading extensions locally (and having them stay loaded between sessions) in Chromium browsers is trivial: Developer mode is enabled with a slider at top of Extensions in Settings, and you can just unzip extension releases directly from the Github to some convenient place in your home directory and load it manually.  For shopping purposes in this secondary browser, I'd say you could go easy and just install uBlock Lite (Manifest V3 version of uBlock Origin) and otherwise just set browser to Clear cookies and site data when you close all windows.  Most shopping sites nowadays don't seem to balk much at disabling third-party cookies for all windows ime, so Cookie Autodelete might not be completely necessary either if you're trashing site data when you close browser anyway.
 

On 12/11/2022 at 5:15 AM, OpenSourcerer said:

If you want a CEF-based browser but don't want to build 40000+ source files, as is the case with Chromium, have a look at Falkon.

If Falkon is effectively treated by sites as if it were Chrome, this might be another option.  Thanks for the tip!

[iwih2gk 93]

Have you tried a simple solution like masking your user agent string?  I have Tax services, Banks, etc.... where even though I am on linux and FF they think I am connecting on Win 10/11 using Chrome and they let me in with no issues.  Just mentioning this in case it would work for you.  FF has good extensions for user agent changing!  If I forget to trigger the user agent when I connect I get the "middle finger"!

You seem to mention you are doing this above but I wanted to be clear in case you aren't.  FF profiles for each place (if there are just a few) would allow you to create unique connection details that would persist since they live inside the FF instance created for the one site.

[win8 7]

https://ungoogled-software.github.io/ungoogled-chromium-binaries/releases/appimage/64bit/108.0.5359.125-1

Maybe this helps as well :-)