Re: Android Marshmallow permissions model

David Nicol <[email protected]> wrote:

>giving the app a fake gps locator
>>
>
>You could become the Foursquare mayor of places you've never even been!

You can do that with a curl script, and many people have...

This points out an interesting trust issue in the IoT/mobile domain,
BTW.  No existing mobile device I am aware of provides a way for an
app to obtain a GPS position from the hardware that the app can then
present to a server in a way that the server can have some assurance
that the app hasn't tampered with the coordinates in transit.  In
other words, there's no way to establish a trusted path between the
GPS receiver and the server, even if the app wishes to enable this.
This could be addressed with a tiny bit of silicon in the phone at
probably zero marginal cost, but none of the incumbent device
manufacturers have thought to do this.  (And this applies not only to
GPS but to any kind of sensor hardware.)

Chip