We are developing an Android/iOS app. This app tracks the user's GPS coordinates and send them to the server along with other data. The integrity of the sent data is too critical for our service. We would like to confirm that the data is actually coming from our app and not from the user as he/she can send fake data. Encryption alone can be defeated by reverse engineering to extract the required keys. Is there a way to authenticate the application itself?

Kind regards

marked as duplicate by Xander, TildalWave, Gilles, Steve, Mark Sep 29 '14 at 19:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • How capable do you estimate the users are? i.e. are they able to inspect your binaries on their system and possibly modify them, or to sniff network communications in any way? – Steve Dodier-Lazaro Sep 29 '14 at 17:24

No, at least not without being a device administrator and locking down a bunch of stuff on the phone. Android very intentionally supports fake GPS information for debugging purposes and as far as I know, you would need to be able to disable that, which would be difficult if not impossible to do without being a device administrator and even then wouldn't necessarily be guaranteed.

Elaborate setups could even potentially spoof GPS data with actual radio waves as a high tech hack to it.


You might want to consider using hybrid locational services to validate your GPS inputs. This Wikipedia page on Wi-Fi location services should be a good start - http://en.wikipedia.org/wiki/Wi-Fi_positioning_system

Not the answer you're looking for? Browse other questions tagged or ask your own question.