Re: Android Marshmallow permissions model

You're absolutely right. Having worked with embedded GPS, I am confident
that if GPS module manufacturers wanted to add a crypto and per-device keys
 in order to provide signed coordinate+timestamp data, no extra hardware
would be needed. They've already got per-device serial numbers. The
relevant industry standard would have to grow a page or two, that's all.
The extended protocol would have to support two additional verbs:

   - request signed result instead of plain result
   - request per-device self-signed public key also signed by manufacturer

and the manufacturer would guarantee that (like with a mintchip) one can't
extract the private key from the hardware.

That last bit might require a touch of engineering, don't know how much.


On Wed, Oct 14, 2015 at 5:23 PM, Chip Morningstar <[email protected]> wrote:

> David Nicol <[email protected]> wrote:
>
> >giving the app a fake gps locator
> >>
> >
> >You could become the Foursquare mayor of places you've never even been!
>
> You can do that with a curl script, and many people have...
>
> This points out an interesting trust issue in the IoT/mobile domain,
> BTW.  No existing mobile device I am aware of provides a way for an
> app to obtain a GPS position from the hardware that the app can then
> present to a server in a way that the server can have some assurance
> that the app hasn't tampered with the coordinates in transit.  In
> other words, there's no way to establish a trusted path between the
> GPS receiver and the server, even if the app wishes to enable this.
> This could be addressed with a tiny bit of silicon in the phone at
> probably zero marginal cost, but none of the incumbent device
> manufacturers have thought to do this.  (And this applies not only to
> GPS but to any kind of sensor hardware.)
>
> Chip
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>



-- 
"If I can quote Alice Walker, 'The biggest way people give up power is by
not knowing they have it to start with.' " -- Jill Stein, the most
successful female candidate for POTUS to date

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk