如何使用 HTML5 获取经过验证的位置？
我最近一直在研究 HTML5 位置查找，从 iPhone 等设备中提取某人的位置相对简单。
我想编写一个使用位置数据的应用程序，但位置必须真实，这一点很重要。换句话说，我需要防止人们使用模拟的 GPS 坐标向支持网站/网络服务编写虚假帖子。
无论如何，是否可以使用 HTML5 地理定位 API 从移动设备收集 GPS 坐标，并将其安全地传输回 Web 服务，这样某人就无法使用相同的数据编写帖子并“欺骗系统”，因此说话？
I've been playing with HTML5 location lookups recently and its relatively straightforward to pull someones location from a device like an iPhone.
I want to write an app that uses location data, but its important that the location be factual. In other words I need to prevent people from authoring a fake post to the backing website / web service with mocked up GPS coordinates.
Is there anyway to collect GPS coordinates from a mobile device using the HTML5 geolocation apis and securely transmit that back to a web service in a way that someone wouldn't be able to author a post with the same data and "game the system" so to speak?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
客户端上的有效负载必须经过严格的加密。如果涉及金钱，有人会进行逆向工程并弄清楚如何自己创建有效的有效负载。请记住，如果涉及金钱或名誉，那么有人会认为做这样的事情的努力是“值得的”。如果您的网络服务是公开的并且没有使用某种加密，则客户端上的没有将确保具有网络连接的人无法嗅探您的协议并伪造他们想要的任何数据。 SSL 不会解决这个问题。任何人都可以代理本地网络上的 SSL 连接解密有效负载并检查它尽其所能。
Not without some serious encryption on the payload on the client. Which if there is money involved, someone will reverse engineer and figure out how to create valid payloads themselves. Remember if there is money or fame involved then somebody will think the effort to do something like this is "worth it". If your web service is public and not using some kind of encryption nothing on the client will ensure that someone with a network connection can't sniff your protocol and fake whatever data they want. And SSL won't cut it. Anyone can proxy the SSL connection on their local network decrypt the payload and inspect it to their hearts content.
不，完全同意模糊棒棒糖的回答。如果您正在与远程计算机交谈，则数据总是可能是伪造的。永远永远。是什么让您确定您正在与移动设备通话？用户代理字符串？噗，是可以造假的。与 GPS 通话？噗，可能来自预定义的路径。与网络浏览器对话？噗，可能是机器人，或者其他一些恶意软件。
并且不要认为加密（即 HTTPS）会对您有所帮助。客户端可以即时编辑您的任何 HTML、CSS 或 JavaScript — 以 Firebug 或 Greasemonkey 为例。
您不能信任客户端的原因与 SQL 或 HTML 注入等漏洞如此常见的原因相同。听说过“顾客永远是对的”这句话吗？好吧，客户可能是对的，但客户总是不值得信任的。
系统是用来玩游戏的。当发现缺陷时，你将它们一一修补。这更像是跨越式发展，而不是实现圣杯。 Bruce Schneier 的俏皮话“安全是一个过程，而不是一个产品”介意。要求一个“不能被玩弄”的系统没有抓住重点。您需要做的是创建一个系统，让服务器清理数据和/或拒绝不良数据——模糊测试也不是一个坏主意。
这就是您可以做的最好的事情，而无需将带有 ROM 中的操作系统且内部用环氧树脂密封的定制的不可篡改的手机运送给您的客户。
No. Completely agree with the answer from fuzzy lollipop. If you’re talking to a remote machine, the data can always be faked. Always always. What makes you certain you’re even talking to a mobile device at all? The User-Agent string? Pfft, it can be faked. Talking to a GPS? Pfft, could be coming from a predefined path. Talking to a web browser? Pfft, could be a bot, or some other malware.
And don’t think encryption (i.e. HTTPS) is going to help you. The client could edit any of your HTML, CSS, or JavaScript on-the-fly — take Firebug or Greasemonkey for example.
The reasons why you can’t trust the client are the same as the reasons why exploits such as SQL or HTML injection are so common. Ever heard the phrase “the customer is always right”? Well, the customer may be right, but the client is always untrustworthy.
The system is there to be gamed. As flaws are discovered, you patch them one by one. It’s more like leapfrog, rather than achieving the holy grail. Bruce Schneier’s quip “security is a process, not a product” comes to mind. Asking for a system that “can’t be gamed” is missing the point. What you need to be doing is creating a system where the server sanitises the data, and/or rejects bad data — fuzz testing is not a bad idea, either.
That’s about the best you can do without shipping custom untamperable mobiles to your customers with the OS in ROM, and the inside sealed with epoxy.