VPN-alone is weak opsec. It changes your exit IP and that’s the whole trick. Meanwhile your browser leaks entropy everywhere: user agent, screen size, timezone, installed fonts, canvas/WebGL hashes, audio fingerprint, and your extension list — each add-on detectable through web-accessible resources, injected DOM, blocked bait requests, or timing tells. uBlock + Privacy Badger + Stylus + some niche translator + Vimium = probably a globally unique signature that follows you across every VPN exit you use. EFF’s Cover Your Tracks has been showing this for a decade. Customization is identity. And WebRTC just hands your real IP over anyway. STUN requests for peer discovery go straight through the tunnel in most default setups and leak both your local and real public IP to any page that asks — VPN connected, doesn’t matter. DNS leaks work the same way: if the OS resolver isn’t forced through the tunnel, you’re querying your ISP while pretending to be in Romania. Add OS telemetry, background apps phoning home, clock skew, TLS fingerprints (JA3/JA4) — none of which a VPN touches — and the “I’m anonymous because VPN xyz” idea falls apart. Tor Browser exists exactly because the only winning move against fingerprinting is to look identical to everyone else. Anything custom is a name tag.
There are cases where Iranian feminist authors and freedom fighters live in exile — for instance in Germany — and use their phones completely normally, whether Apple, Android, or whatever else. Yet Iranian agents still manage to track them. The reason is that the data is simply bought from data brokers: the Iranian regime purchases it and then sends people to observe these women in person.
Data broker tracking can be curtailed with a VPN, but a VPN alone does relatively little. What matters more is blending into the largest possible crowd. The point of using something like a default Firefox setup isn’t the browser itself — it’s that you end up with the same screen resolution, the same fonts, the same default settings that the largest number of people on the planet also have. If your browser deviates from that baseline, then details such as when you’re online, which apps you’ve installed, which websites you visit, which fonts and add-ons you have, your browser settings, your user agent, and so on, can uniquely identify you or single you out. The whole game is to keep the indistinguishable mass as big as possible: if someone knows the person they’re hunting is in a certain group, you want that group to be huge.
Once that fingerprint is known, you can be re-identified even under a different IP. So the data brokers who buy data from Facebook, Instagram, or wherever still have what they need. It’s also been shown that apps communicate with each other in ways that allow unique attribution across them. And depending on which country you live in, default regional versions — US builds, Apple US, and the like — aren’t necessarily privacy-compliant; whether that’s actually illegal depends on the jurisdiction.
On a desktop PC, the situation is similar. There it depends heavily on which browser you use. If you take a browser with completely default settings and then surf either with or without a VPN, you’ll be recognized all the same — meaning users can be de-anonymized regardless. So it really doesn’t help much at all.
And while we’re at it — go on, tell me what exactly in my last message you think I didn’t come up with myself. Be specific. Which sentence, which idea? I’d genuinely like to know what you think was put in my head.