I am writing a server to support a local application for iOS and Android. The app requires us to verify the user's identity and location. I know how to do the first, but not the last.
Is it possible to verify that the sender that the client sends to me is actually the best estimate of his current location? I worry that a malicious client spoofs a location and pretends to be a system.
CLARIFICATION: I would like to know how the server can trust through some kind of location verification process that it sent.
I can figure out how to get the user's location from the device. For example, on the Android platform, my application would register to get android.location.Location s, pull out lat / lon and send it to the server.
But how can I convince the server that I didnโt just do it? From the serverโs point of view, why should it assume, when lat / lon is set, that the user is actually there (or next to it for sure)?
Perhaps there is some way to sign the data?
How do servers for apps like foursquare and Facebook verify that the location data they give it is not faked?
source share