3

I'm making a new app for mobile platforms that uses GPS to track the user position and I need to trust that the location.

So how can I make my mobile app trust the GPS location received? Nowadays it's easy to fake it with apps. The only solution I've found was to test if there was a mock on the GPS, but even that can be easily bypassed.

I'm building the app with Cordova.

jonrsharpe
  • 115,751
  • 26
  • 228
  • 437
Diogo Silva
  • 31
  • 1
  • 5
    You can't trust the location; *why* do you think you need to? – jonrsharpe Feb 06 '16 at 18:33
  • Because I want to "make moves" depending on the location of that person, and if he is faking it he might be earning something he can't. So there isn't a way to prevent faking gps location? – Diogo Silva Feb 06 '16 at 20:34
  • Not sure what you mean by *"make moves"* but no, you're at the mercy of the data from the browser/device which cannot necessarily be trusted. – jonrsharpe Feb 06 '16 at 20:35
  • What I meant was imagine he hit that location, I want to give him a trophy. If forging data is possible then it's kinda bad. Isn't there ways like calculating the time someone moved from one point to other and give it a margin of error or something? – Diogo Silva Feb 06 '16 at 20:40
  • Does it really matter if (probably relatively few) people cheat? You could of course use historical data to determine the likelihood of legitimate data, but it's still no guarantee and probably not worththe effort. – jonrsharpe Feb 06 '16 at 20:42
  • It does matter, anyone can cheat, if you search for fake gps position you find tons of apps which can simulate it. But thanks for the help I'll wait a bit more to see if anyone has some kind of workaround! – Diogo Silva Feb 06 '16 at 20:44
  • Yes, anyone *could* cheat, but many won't and my point is that it's likely that what you're doing isn't sufficiently critical that it actually *matters* if anyone (or even everyone) does. And if it is that important then you shouldn't be trusting anyone's data. – jonrsharpe Feb 06 '16 at 20:46
  • Make him prove that he is in the right place - Ask him to send you a picture from that location. – TDG Feb 07 '16 at 16:16

3 Answers3

1

There are a few ways to check if the user is faking their location. One way is to check if they have 'Allow mock locations' checked in the Developer Settings. A way to do this is with the following code:

if (Settings.Secure.getString(getActivity().getContentResolver(), Settings.Secure.ALLOW_MOCK_LOCATION).equals("0")) {
    //Allow Mock Locations is enabled!
}

or if they are on Android 6+:

@Override
public void onLocationChanged (Location location){
    boolean isMockLocation = location.isFromMockProvider();
}

Although these will help with many of the fake location apps out there, it is no guarantee that someone hasn't found a way around this.

Pablo Baxter
  • 2,144
  • 1
  • 17
  • 36
0

If you cannot trust any user, and you cannot trust the user's device, then nothing coming from the user or the device can be trusted.

So, if you want to eliminate all cheating, there is only one real thing you can do:

  • Hire a trustworthy employee to be at that location, and have your employee inform you of who shows up.

You might compromise, and ask them to send you a postcard of that location, bought from that location, post-stamped from that location, but then some local tourist shop might sell the service of mailing you postcards for a small fee, and you're back to having possible cheaters.

Alternately, give up on the idea you can use an app on a user's device to prevent fake locations from being sent, and work with what you have.

Anti-weakpasswords
  • 2,604
  • 20
  • 25
0

try to read GPS specification. I don't know, but may be you can trust to satellite's data with timestamp and signatures, if you are able to receive such data from user. User can't fake satellites - they are complex and hardly accessible devices.

xsp-server-hater
  • 55
  • 1
  • 1
  • 9