GPS, Wi-Fi, GSM and IP: what each can and cannot establish

Definition

GPS, Wi-Fi, GSM and IP: what each can and cannot establish

Each location signal fails differently: GPS is precise outdoors and spoofable in software, Wi-Fi is precise indoors and dependent on a database of known networks, GSM is coarse and hard to forge, and IP establishes only where packets entered the network.

Signal	Good at	Bad at	How it is faked
GPS / GNSS	Metres, outdoors, anywhere on earth	Indoors, urban canyons, cold start	Mock-location apps in software; radio spoofers in hardware
Wi-Fi	Indoors, dense areas	Rural areas, new routers, moved equipment	Replaying or broadcasting known network identifiers
GSM / cellular	Coarse position that is hard to forge from software	Precision, devices with no cellular radio	With radio equipment, so it is rarer
IP	Country, cheaply, with nothing from the user	Anything below country level, routed traffic	A VPN, proxy or residential IP service

Combining signals raises the cost of faking them

Using several signals together is standard practice, and it helps: faking GPS, Wi-Fi and cellular so that they agree is harder than faking one. But if software the user controls reads every signal, a modified device can make all of them report the same false place.

The integrity of the environment that reads the signals matters more than the number of signals.

That is why most of the work in a device check goes into the environment: whether the operating system is modified, whether a mock-location provider is active, whether the app is the app. See device integrity checking, and device-attested location for anchoring the result in hardware.

Phone sensors add a physical check

Phones also carry motion, magnetic and barometric sensors. Their readings show whether the device moves like a phone carried by a person. A server rack or an emulator produces no such readings, and a false location that must stay consistent with them costs far more to maintain. Octet builds a statistical proof from hundreds of inputs, from inertial sensors to radio signals to on-device data that other location methods usually ignore, before it computes location. Those readings never leave the device. See proof of location.