4 ms·

Ride hailing apps rely on the fact that both customers and drivers phones don't lie about their location. Mapping companies rely on the fact that their crowdso

Ride hailing apps rely on the fact that both customers and drivers phones don't lie about their location. Mapping companies rely on the fact that their crowdsourced data is reliable. Emergency services rely on the fact that phones share accurate locations. Delivery companies require authentic location data from their agents. Apps that allow people to rent scooters or bicycles rely on non-fake location data. If you made it easy to provide fake location data, a lot of apps would suddenly have to deal with a whole new class of fraud. I just don't see how this would be a net beneficial change.

nayuki 2y ago
> Apps that allow people to rent scooters or bicycles rely on non-fake location data. There's a way to fix this. Each bicycle can store a private key, and your phone needs to talk to the bike nearby to do a live challenge-response before you can rent it out.
- NotPractical 2y ago
  I'm pretty sure they already do that. As always, the standard network security advice is "don't trust the client", and yeah, it'd be nice to be able to trust the client, but it would also mean the total abandonment of any meaningful user control over their own devices, so it's not worth it IMO.
codebje 2y ago
You can separate all of those examples into one of two categories: one in which the owner of the phone has a vested interest in providing accurate location and an easy means to enforce consequences for undesired behaviour (I want my ride to find me, I want emergency services to help me, I want to find a bike near me), and another in which a company hopes to use someone else's information for free for their own benefit: delivery companies with a "bring your own phone" policy, or crowdsourcing companies hoovering up free data to build their value. Since I paid for my phone, I really don't see why it's incumbent on me to help the latter case out. A delivery company is free to supply a managed device or fit a device to their trucks. A crowdsourcing company should in any case already be assuming all client data is suspect and ensuring it's properly correlated with other sources of information. There's no fraud here. The worst case outcome in your list is perhaps a delivery agent just having their phone say they've done a particular route when they just sat in the movie theatre or whatever, but the fact that none of their packages got delivered is enough to out them even if the shipping company is trying to get location data for free from a device the shipping company doesn't even own. If I hire a bike I'm nowhere near I still pay for it. Denial of service attacks in which the perpetrator is fully responsible for the cost of resources consumed just aren't a thing that happens. The only group involved in these scenarios that's taking adverse action against another party for their own gain is the entitled companies demanding users' phones be locked down so they can continue to get material gain from them without compensation. The net benefit here is that these companies' profits should definitely be taking a back seat to users' rights.
- newaccount74 2y ago
  I think you are stuck in an "us vs. them" mindset. It's not all consumers vs corporations. Consumers actually want to use services offered by companies, and willingly accept what you consider drawbacks. We want accurate traffic data in maps, and crowd-sourced key finders, and all the other conveniences afforded by unspoofable location data, and we give up a little bit of control in exchange for that. Companies don't compensate us with money for crowdsourced data; they compensate us by offering services they couldn't offer otherwise.
  - codebje 2y ago
    Crowdsourced data is not individually reliable and is already accounting for invalid and incorrect submissions. We can have our cake and eat it too. The ‘us vs them’ mindset comes from ‘then’ determining what is acceptable for ‘us’ to do purely because it’s good for ‘them’. If I want to set my location to somewhere I am not, and the only reason I can’t is corporate interests, then a battleground has been drawn up by those interests, not me.
    - newaccount74 2y ago
      What I am trying to say is that there is no strict difference between "user interests" and "corporate interests". Companies in general don't want reliable data for the fun of it; they want it in order to provide services that users want.

nayuki 2y ago

> Apps that allow people to rent scooters or bicycles rely on non-fake location data. There's a way to fix this. Each bicycle can store a private key, and your phone needs to talk to the bike nearby to do a live challenge-response before you can rent it out.

NotPractical 2y ago
I'm pretty sure they already do that. As always, the standard network security advice is "don't trust the client", and yeah, it'd be nice to be able to trust the client, but it would also mean the total abandonment of any meaningful user control over their own devices, so it's not worth it IMO.

codebje 2y ago

You can separate all of those examples into one of two categories: one in which the owner of the phone has a vested interest in providing accurate location and an easy means to enforce consequences for undesired behaviour (I want my ride to find me, I want emergency services to help me, I want to find a bike near me), and another in which a company hopes to use someone else's information for free for their own benefit: delivery companies with a "bring your own phone" policy, or crowdsourcing companies hoovering up free data to build their value. Since I paid for my phone, I really don't see why it's incumbent on me to help the latter case out. A delivery company is free to supply a managed device or fit a device to their trucks. A crowdsourcing company should in any case already be assuming all client data is suspect and ensuring it's properly correlated with other sources of information. There's no fraud here. The worst case outcome in your list is perhaps a delivery agent just having their phone say they've done a particular route when they just sat in the movie theatre or whatever, but the fact that none of their packages got delivered is enough to out them even if the shipping company is trying to get location data for free from a device the shipping company doesn't even own. If I hire a bike I'm nowhere near I still pay for it. Denial of service attacks in which the perpetrator is fully responsible for the cost of resources consumed just aren't a thing that happens. The only group involved in these scenarios that's taking adverse action against another party for their own gain is the entitled companies demanding users' phones be locked down so they can continue to get material gain from them without compensation. The net benefit here is that these companies' profits should definitely be taking a back seat to users' rights.

newaccount74 2y ago
I think you are stuck in an "us vs. them" mindset. It's not all consumers vs corporations. Consumers actually want to use services offered by companies, and willingly accept what you consider drawbacks. We want accurate traffic data in maps, and crowd-sourced key finders, and all the other conveniences afforded by unspoofable location data, and we give up a little bit of control in exchange for that. Companies don't compensate us with money for crowdsourced data; they compensate us by offering services they couldn't offer otherwise.
- codebje 2y ago
  Crowdsourced data is not individually reliable and is already accounting for invalid and incorrect submissions. We can have our cake and eat it too. The ‘us vs them’ mindset comes from ‘then’ determining what is acceptable for ‘us’ to do purely because it’s good for ‘them’. If I want to set my location to somewhere I am not, and the only reason I can’t is corporate interests, then a battleground has been drawn up by those interests, not me.
  - newaccount74 2y ago
    What I am trying to say is that there is no strict difference between "user interests" and "corporate interests". Companies in general don't want reliable data for the fun of it; they want it in order to provide services that users want.