4 ms·

I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.

tablespoon 4y ago
> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS. One reason is that GPS doesn't work well (or at all) indoors, through cell-tower geolocation should work well enough for that case.
- thelopa 4y ago
  A compromised device can send a false location or the user may have disabled location. Geolocation has relatively predictable failures.
bierjunge 4y ago
GPS can be easily spoofed. Back in the university days, we (me + a few friends) used to get some radios and antennas to create a signal stronger than the one coming from satellites. It was always fun when the semester started and all freshmen were using Google Maps to navigate through the campus, but the map always showed their location in North Korea. Good ol' times.
- pphysch 4y ago
  I thought GPS worked by triangulation? How did you use one transmitter to specifically misdirect receivers to believing they were in North Korea?
  - ballenf 4y ago
    > some radios and antennas Still an impressive feat.
    - zikduruqe 4y ago
      I'm calling shenanigans. I used to work in a lab where we had GPS repeaters to test consumer equipment. That alone costs big bucks. And, we had the FAA come down on us big time, because our GPS repeater broadcast outside the building too far and we got into some hot water. If you were spoofing GPS campus wide over 1.544 GHz and had all your GPS sentences correct, with simple radios and antennas... and you hadn't got in trouble with Uncle Charlie or the FAA....
      - imwillofficial 4y ago
        Spoofing GPS is trivial. Getting caught or not is a toss of the coin
        zikduruqe 4y ago
        Cheating the location on my phone is gravy. Broadcasting an RF signal to spoof GPS (and especially across a campus), that my friend, is not trivial or cheap.
        Dylan16807 4y ago
        Trying to set up an alternate 3d volume of GPS space sounds very difficult. But broadcasting a loud signal that tells everyone in range that they are at the same exact point doesn't seem too hard to me. Couldn't that even be as simple as replaying a single-antenna recording taken somewhere else?
        londons_explore 4y ago
        Yes exactly. Doesn't work well with some receivers that cache data from the real network and stay locked onto the much weaker real signal. But works with most receivers.
        livueta 4y ago
        > not trivial or cheap From your previous comment, it sounds like your experience may have been from a while ago? In 2022, it is fairly trivial and cheap: https://github.com/osqzss/gps-sdr-sim https://github.com/osqzss/gps-sdr-sim I can not ;^) personally confirm that this works with a HackRF, which is like $300, but probably also with any other reasonable tx-capable sdr.
mritzmann 4y ago
Fraud detection happens on the server side. The IP address is more reliable than GPS, because the client can fake GPS at any time.
- rosnd 4y ago
  But Apple Pay doesn't require internet (on the phone).
culturestate 4y ago
> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS. I don't think contactless Apple Pay actually uses device geo[1] for authorization, but it's still worth noting that iOS devices without cell connectivity (ie WiFi-only iPads) don't have GPS anyway. You can use Apple Pay on websites in Safari, though, which IIRC doesn't require location permissions to work. 1. You have to be able to use it in the same places you'd use a normal card, which means you can't rely on network connectivity of any kind.
- ev1 4y ago
  Some Visa cards do [1] now, https://pbs.twimg.com/media/FQyVcUHXEAMSKbt?format=jpg&name=orig https://pbs.twimg.com/media/FQyVcUHXEAMSKbt?format=jpg&name=... and can refuse authorisation if it's not sent. Apple's statement was "to prevent the sharing of fraud prevention assessments with your payment card network, you may select another card". I removed my Visa cards from Apple Pay.
  - culturestate 4y ago
    I’d never come across that before, but quickly looking at the statement from Apple it seems like this only applies to browser and in-app purchases, not contactless transactions where you’re using your phone in lieu of a physical card: "For cards with certain enhanced fraud prevention, when you attempt an online or in-app transaction, your device will evaluate information about your Apple ID, device, and location (if you have enabled Location Services), to develop fraud prevention assessments, which are used by Apple to identify and prevent fraud."

> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS. One reason is that GPS doesn't work well (or at all) indoors, through cell-tower geolocation should work well enough for that case.

thelopa 4y ago
A compromised device can send a false location or the user may have disabled location. Geolocation has relatively predictable failures.

bierjunge 4y ago

GPS can be easily spoofed. Back in the university days, we (me + a few friends) used to get some radios and antennas to create a signal stronger than the one coming from satellites. It was always fun when the semester started and all freshmen were using Google Maps to navigate through the campus, but the map always showed their location in North Korea. Good ol' times.

pphysch 4y ago
I thought GPS worked by triangulation? How did you use one transmitter to specifically misdirect receivers to believing they were in North Korea?
- ballenf 4y ago
  > some radios and antennas Still an impressive feat.
  - zikduruqe 4y ago
    I'm calling shenanigans. I used to work in a lab where we had GPS repeaters to test consumer equipment. That alone costs big bucks. And, we had the FAA come down on us big time, because our GPS repeater broadcast outside the building too far and we got into some hot water. If you were spoofing GPS campus wide over 1.544 GHz and had all your GPS sentences correct, with simple radios and antennas... and you hadn't got in trouble with Uncle Charlie or the FAA....
    - imwillofficial 4y ago
      Spoofing GPS is trivial. Getting caught or not is a toss of the coin
      - zikduruqe 4y ago
        Cheating the location on my phone is gravy. Broadcasting an RF signal to spoof GPS (and especially across a campus), that my friend, is not trivial or cheap.
        Dylan16807 4y ago
        Trying to set up an alternate 3d volume of GPS space sounds very difficult. But broadcasting a loud signal that tells everyone in range that they are at the same exact point doesn't seem too hard to me. Couldn't that even be as simple as replaying a single-antenna recording taken somewhere else?
        londons_explore 4y ago
        Yes exactly. Doesn't work well with some receivers that cache data from the real network and stay locked onto the much weaker real signal. But works with most receivers.
        livueta 4y ago
        > not trivial or cheap From your previous comment, it sounds like your experience may have been from a while ago? In 2022, it is fairly trivial and cheap: https://github.com/osqzss/gps-sdr-sim https://github.com/osqzss/gps-sdr-sim I can not ;^) personally confirm that this works with a HackRF, which is like $300, but probably also with any other reasonable tx-capable sdr.

mritzmann 4y ago

Fraud detection happens on the server side. The IP address is more reliable than GPS, because the client can fake GPS at any time.

rosnd 4y ago
But Apple Pay doesn't require internet (on the phone).

culturestate 4y ago

> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS. I don't think contactless Apple Pay actually uses device geo[1] for authorization, but it's still worth noting that iOS devices without cell connectivity (ie WiFi-only iPads) don't have GPS anyway. You can use Apple Pay on websites in Safari, though, which IIRC doesn't require location permissions to work. 1. You have to be able to use it in the same places you'd use a normal card, which means you can't rely on network connectivity of any kind.

ev1 4y ago
Some Visa cards do [1] now, https://pbs.twimg.com/media/FQyVcUHXEAMSKbt?format=jpg&name=orig https://pbs.twimg.com/media/FQyVcUHXEAMSKbt?format=jpg&name=... and can refuse authorisation if it's not sent. Apple's statement was "to prevent the sharing of fraud prevention assessments with your payment card network, you may select another card". I removed my Visa cards from Apple Pay.
- culturestate 4y ago
  I’d never come across that before, but quickly looking at the statement from Apple it seems like this only applies to browser and in-app purchases, not contactless transactions where you’re using your phone in lieu of a physical card: "For cards with certain enhanced fraud prevention, when you attempt an online or in-app transaction, your device will evaluate information about your Apple ID, device, and location (if you have enabled Location Services), to develop fraud prevention assessments, which are used by Apple to identify and prevent fraud."