Question

I’ve been playing with HTML5 location lookups recently and its relatively straightforward to pull someones location from a device like an iPhone.

I want to write an app that uses location data, but its important that the location be factual. In other words I need to prevent people from authoring a fake post to the backing website / web service with mocked up GPS coordinates.

Is there anyway to collect GPS coordinates from a mobile device using the HTML5 geolocation apis and securely transmit that back to a web service in a way that someone wouldn’t be able to author a post with the same data and “game the system” so to speak?

Answer 1

Not without some serious encryption on the payload on the client. Which if there is money involved, someone will reverse engineer and figure out how to create valid payloads themselves. Remember if there is money or fame involved then somebody will think the effort to do something like this is “worth it”. If your web service is public and not using some kind of encryption nothing on the client will ensure that someone with a network connection can’t sniff your protocol and fake whatever data they want. And SSL won’t cut it. Anyone can proxy the SSL connection on their local network decrypt the payload and inspect it to their hearts content.