Why does this fork exist?

The original code by a (comparatively) trusted source Kostas Chatzikokolakis (a trusted repo since 2016) is now effectively broken due to OpenStreeMaps blocking the plugin. Fair enough if it's against their TOS. Another user https://github.com/DrewHood/location-guard forked and solved.

What did the original extension do?

It would allow the browser to lie to a website about it's actual location, you could do this for all websites with varying degrees of 'blur' around your actual location without giving it away, OR you could get it to lie to a specific website and give that specific website a false pinned location for you. Cool stuff for privacy, research, or handling how nosy websites change what they show you based on what your location is perceived to be. (Very neat when combined with a VPN that exits near where you pin the browser to).

## Why bother doing this?

You shouldn't run code off the internet without checking it first, or getting an agent to do it. Opus 5.5 did a code-review of Drew's work and confirmed no malicious changes or obfuscated code. Good enough for me anyways.

So, credit to Kostas, and Drew for doing all the hard work, and thanks to you Claude (I guess) for telling us that it's not a crazy thing to do to run this on your browser. (Full Claude output pasted below for you dear reader if you want to check what it says, or just ask another agent to check again.)

Opus 5.5 opinion of the fork

__ I found nothing malicious in the fork. It's two small commits on top of the latest upstream chatziko/location-guard, and the changes do what their messages say. The extension builds and runs in Firefox, and all 16 location tests passed. It won't run in modern Chrome browsers (version 154+), because that version no longer supports this kind of extension (Manifest V2).

1. Commit review

Provenance: GitHub lists the repo as a fork of chatziko/location-guard. It branches from upstream's latest commit (56fc372, Apr 2022) and has no upstream commits missing. Its only branch is master, with no tags and no releases, so there are no prebuilt binaries to worry about.

Commit	What it changes	Verdict
334963c Fix OSM tile blocking and build errors	Makefile path fixes; lockfile converted to the newer format; adds a Referer header to OpenStreetMap map-tile requests; adds the webRequest and webRequestBlocking permissions	Benign
d299683 Escape input to geocoder	Fixes an injection bug in the place-name search on the settings page; also stops the map's centre (which may be your real location) being sent to the geocoding service	Benign, and improves privacy

• Lockfile: I compared it entry by entry against upstream's. It's the same 189 packages with identical versions, download URLs and integrity hashes. All of them come from registry.npmjs.org, there are no install scripts, and package.json is unchanged.
• The new header code (src/js/main.js:24-34) only fires for *.tile.openstreetmap.org and .de. It replaces the Referer with a fixed GitHub URL and never reads or sends any page data.
• The new permissions sound powerful, but the extension already had access to every site, and this code uses them only for that one header.
• The search fix: I checked it against the original plugin function in node_modules. It's identical except that it escapes HTML first, and a unit test confirmed a <img onerror=…> payload comes out harmless.
• No new network calls: I found no new external addresses, data collection or obfuscated code. The geocoder API key was already in upstream.

Minor issues, none of them malicious:

• The header change applies to OSM tile requests from every website you visit, not just the extension's own pages. It labels them with upstream's GitHub URL. That's harmless, and arguably leaks less than the normal header would, but it could be limited to the extension's own requests.
• Bug: make package-firefox is broken in this fork. The Makefile change makes it output a folder instead of an .xpi file. Zipping build/firefox/ by hand works around it.
• npm ci reports audit warnings. They come from the dependencies upstream already uses, which this fork didn't change.

To build from the pinned version:

git clone --branch reviewed-2026-10-06 https://github.com/agiontheway/location-guard.git
cd location-guard && npm ci --ignore-scripts && make build-firefox
(cd build/firefox && zip -qr ../location-guard.xpi .)   # make package-firefox is broken in this fork

Installing in Firefox without addons.mozilla.org

You're on standard release Firefox (156+, release channel). Release Firefox only permanently installs add-ons that Mozilla has signed, and you can't switch that off there. Without Mozilla's signing service you have two choices:

1. Temporary install (works on your current Firefox). Go to about:debugging#/runtime/this-firefox, click Load Temporary Add-on…, and pick build/firefox/manifest.json or the .xpi. It's removed whenever Firefox restarts, so it suits testing, not daily use.

2. Permanent install (needs a different Firefox build). Use Firefox ESR, Developer Edition or Nightly, which can turn signature checks off:

   • Set xpinstall.signatures.required to false in about:config.
   • Open about:addons, click the gear icon, then Install Add-on From File…, and pick the .xpi.

One thing to fix before a permanent install: the extension uses the same add-on ID as the official Location Guard on addons.mozilla.org (jid1-HdwPLukcGQeOSh@jetpack, set in src/manifest.json). Firefox checks addons.mozilla.org for updates by that ID, so it could replace your pinned build with the official one, which defeats the pin. There are two ways to avoid it:

• Change the ID to one you own (for example location-guard@agiontheway) in your fork, and tag that as the version to install. This is the cleaner option.
• Or, after installing, open the add-on in about:addons and set Allow automatic updates to Off.

Location Guard

Location Guard is a browser extension that allows to protect your location while using location-aware websites, by adding controlled noise to it. It supports the followng browsers:

• Google Chrome / Chromium (install)
• Mozilla Firefox (install)
• Microsoft Edge (install)
• Opera (install)

Location Guard is available under either the MIT/X11 or the CeCILL-B license.

Frequently Asked Questions

What is Location Guard?

Websites can ask the browser for your location (via JavaScript). When they do so, the browser first asks your permission, and if you accept, it detects your location (typically by transmitting a list of available wifi access points to a geolocation provider such as Google Location Services, or via GPS if available) and gives it to the website.

Location Guard is a browser extension that intercepts this procedure. The permission dialog appears as usual, and you can still choose to deny. If you give permission, then Location Guard obtains your location and adds "random noise" to it, creating a fake location. Only the fake location is then given to the website.

To see Location Guard in action use this demo, a geolocalized weather forecast, or go to Google Maps and press the button. When the website asks for your location you will see the the icon in the address bar (which also provides configuration options).

What kind of privacy does Location Guard provide?

Location Guard provides privacy within a certain protection area by ensuring that all locations within this area look plausible for being the real one. This is achieved by adding random noise in a way such that all locations within the protection area can produce the same fake location with similar probability. As a consequence, the fake location provides no information to the website for distinguishing between locations within the protection area.

Warning: background knowledge can still be used by websites to guess the real location within the protection area. For instance, if the protection area is in the middle of a lake containing only a small island, it will be easy to infer that the real location is on the island. In scenarios like this you should choose a higher privacy level or deny disclosing your location at all.

What are "privacy levels"?

The privacy level determines the amount of noise added to your real location. A higher level adds more noise, so the fake location will be further away from the real one. This offers protection within a larger area, but it might make the service provided by the website less useful.

By default all websites use the "medium" level (this can be changed from the extension's options). You can select a different level for a specific website using the icon. For instance, you could select a lower privacy level for websites that need an accurate location (eg. maps), and a higher one for websites that only need approximate information (eg. weather forecast).

For more flexibility, each level can be configured from the Privacy Levels tab. The red circle is the protection area: locations in this area look plausible to be the real one (see "What kind of privacy does Location Guard provide?" above). The blue circle is the accuracy: the fake location will be inside this circle with high probability (note that the noise is random). Use the slider to adapt the two areas to your needs.

What is a "fixed location"?

The privacy level can be set to "Use fixed location". In this case Location Guard always reports to the website a predefined fixed location that never changes (instead of generating a fake location by adding noise to the real one). This offers the highest privacy, since the reported location is completely independent from the real one, at the cost of very low accuracy.

You can modify the fixed location from the extension's options (Fixed Location tab).

When using a fixed location, the browser's geolocation is not performed at all. This offers better privacy, since the list of wifi access points is not transmitted to Google's servers. However, it has the side effect that the permission dialog is not displayed at all. This behaviour is usually acceptable when the fixed location is dummy, but it can be modified if you wish.

Why some websites detect my location although I use Location Guard?

Some websites detect your location based on your IP address (a numerical label associated with every device on the Internet), which is visible to all websites you visit. However, most of the time this type of geolocation is not accurate and is limited to the city or postal/zip code level. Examples of such websites are iplocation.net and tracemyip.org.

Location Guard does not protect your IP address; it hides the location revealed by the browser through the JavaScript API, which is usually very accurate. More information about how the browser obtains your location can be found here.

To hide your IP address you need to use some anonymous communication system such as Tor. Note, however, that even if your IP address is hidden, your browser can still reveal your location through JavaScript, so you need to also use Location Guard.

How Location Guard uses my information?

Location Guard takes your privacy seriously! First, the extension itself has no "special permission" to access your location, it can obtain it only when a website asks for it and only if you allow access in the permission dialog.

Location Guard runs locally in your browser and sends no information whatsoever to the network. It only communicates your fake location to the website that asks for it.

Location Guard also never stores your real location. The fake location is cached for a small period of time; if a website asks for your location during this time the cached fake location will be returned. This improves privacy by avoiding to generate too many fake locations which would be centered around the real one. The cache period can be configured from the extension's options (Privacy Levels tab) and there is also a button to delete the cache.

What is the technology behind Location Guard?

Location Guard is a product of research carried out at the Ecole Polytechnique of Paris, CNRS and Inria. It is based on work by Miguel Andrés, Nicolás Bordenabe, Kostas Chatzikokolakis, Catuscia Palamidessi and Marco Stronati.

Location Guard implements a location obfuscation technique based on adding noise from a 2-dimensional Laplace distribution. This method can be formally shown to provide a privacy guarantee which is a variant of Differential Privacy. More details can be found in the CCS'13 paper, or in the PhD thesis of Nicolas Bordenabe.

Complete list of publications related to Location Guard

Theses

• Measuring Privacy with Distinguishability Metrics: Definitions, Mechanisms and Application to Location Privacy.
  N. Bordenabe. PhD dissertation, École Polytechnique, Paris, 2014. SIGSAC Doctoral Dissertation Award 2015. [pdf]

• Designing Location Privacy Mechanisms for flexibility over time and space. M. Stronati. PhD dissertation, École Polytechnique, Paris, 2015. [pdf]

Papers

• Geo-Indistinguishability: Differential Privacy for Location-Based Systems.
  M. Andres, N. Bordenabe, K. Chatzikokolakis and C. Palamidessi.
  Proc. of CCS '13, ACM, pp. 901-914, 2013. [report]
• Broadening the Scope of Differential Privacy Using Metrics.
  K. Chatzikokolakis, M. Andres, N. Bordenabe and C. Palamidessi.
  Proc. of PETS '13, Springer, LNCS 7981, pp. 82-102, 2013. [report]
• A Predictive Differentially-Private Mechanism for Mobility Traces.
  K. Chatzikokolakis, C. Palamidessi and M. Stronati.
  Proc. of PETS '14, Springer, LNCS 8555, pp. 21-41, 2014. [report]
• Optimal Geo-Indistinguishable Mechanisms for Location Privacy.
  N. Bordenabe, K. Chatzikokolakis and C. Palamidessi.
  Proc. of CCS '14, ACM, pp. 251-262, 2014. [report]
• Geo-indistinguishability: A Principled Approach to Location Privacy.
  K. Chatzikokolakis, C. Palamidessi and M. Stronati.
  Proc. of ICDCIT '15, Springer, LNCS 8956, pp. 49-72, 2015. [report]
• Constructing elastic distinguishability metrics for location privacy.
  K. Chatzikokolakis, C. Palamidessi and M. Stronati.
  PETS'15 / PoPETs, De Gruyter Open, 2015(2): 156-170, 2015. [report]