Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proof of location for online polls

ip-vote.com

Post reply on HN
Print view View original

31–40 of 89 posts

Re: Proof of location for online polls

#31

Post by myself248 »

DeepYogurt wrote: post #26
c-riq wrote: post #12

Earlier quoted context omitted.

That is true, the location proof is only for the hardware whose IP is used for submitting the vote request. However if remote desktop provider / cloud provider / VPN / Tor IPs are already blocked by the voting platform. Then it would require significant effort to acquire hardware in the target geographic region and equip it with a residential IP. Generally the whole setup only makes sense if IP's (or IP ranges) can o…

For a motivated attacker its not that hard to add a few thousand raspberry pis to a residential internet network in most countries. Its really a quite practical attack when the stakes are governmental control.

Or just compromise an entire ISP full of routers...

Re: Proof of location for online polls

#32

Post by dheera »

jawiggins wrote: post #2

> Latency-based geolocation can help protect poll integrity by: > Detecting when poll responses originate from outside the intended geographic region > Identifying attempts to manipulate polls through elevated VPN/proxy usage Unless the user also needs to complete a reaction-time test, couldn't this be defeated by using a remote desktop connection to a machine that is physically located in the other geography? It jus…

Yes, and also, I'd argue that anonymizing your location is a sacred feature of the internet that anytime someone builds a better mousetrap we WILL build a better mouse. The internet is not a place where requiring proof of location is welcome.

For online polls, it should never be necessary, either: My rights to vote somewhere should depend only on my membership status to that somewhere, and not my current physical location.

Re: Proof of location for online polls

#33

Post by kvdveer »

KaoruAoiShiho wrote: post #8

Fantastic, solves the issue of bots from foreign adversaries. Everyone complaining doesn't seem to get it, it doesn't need to solve all usecases, but solving this one usecase is great. Conversely, can this be used to show that someone is NOT a chinese/russian bot? I've had enough with people accusing me lol.

Yesterday I fought off someone/something doing Chinese language crypto-blogspam on my website. Ip-addresses were all unique (mixed ipv4&ipv6), but all were 'located' within 100km of my server in central Europe.

If crypto-scammers can bypass geo-restrictions for blogspam, I'm confident that state-level actors can do that even better for geopolitics.

Re: Proof of location for online polls

#34

Post by banana_giraffe »

polon wrote: post #5
jawiggins wrote: post #2

> Latency-based geolocation can help protect poll integrity by: > Detecting when poll responses originate from outside the intended geographic region > Identifying attempts to manipulate polls through elevated VPN/proxy usage Unless the user also needs to complete a reaction-time test, couldn't this be defeated by using a remote desktop connection to a machine that is physically located in the other geography? It jus…

I think this is covered on the page "Successfully manipulating a poll which employs this method would require following efforts and resources: Gaining control over a large number of devices in the target geographic region for submitting votes through those devices" So yes, it seems like it can be defeated via a remote desktop (or any proxy in the allowed area)

> Gaining control over a large number of devices in the target geographic region for submitting votes through those devices

Does AWS Lambda count as a machine for these purposes? If so, you can get a nearly infinite number of them just by cycling a config param and casting another vote.

Re: Proof of location for online polls

#35

Post by kvdveer »

There are a lot of valid critiques already, but here's another:

This technique will have to allow for over-all slow connections. This connection latency could be caused by over-provisioned office connections, torrents, bad gsm reception, cheap internet or a cheap device.

What prevents a client from strategically delaying specific requests, to simulate a slow device in the target geography. AFAIT, this would be indistinguishable from the scenarios mentioned above.

Re: Proof of location for online polls

#36

Post by jampekka »

mac3n wrote: post #14

having worked on IP geolocation in the past, I don't think this works. Though it can do a pretty good job of getting you in the right continent. * Not all traffic goes through fiber - there are microwave links operating closer to the speed of light, though these are mostly reserved for high-speed trading. There's also satellite connections, but as long as they don't do satellite-staellite, they're slower. * There are…

> there are microwave links operating closer to the speed of light, though these are mostly reserved for high-speed trading

This is so sad.

Re: Proof of location for online polls

#37

Post by SteveVeilStream »

It's an interesting concept.

Re: "Cannot be manipulated unlike GPS signal derived coordinates, which can be altered by the user's device before relaying them to the server"

Is it possible to ensure that the data is not manipulated? If the user had to install a voting software package on their phone, then couldn't that piece of software take responsibility for pulling the co-ordinates from the device and encrypting it? I am assuming most modern phones are secure enough that the signal from the GPS that is made available to applications can be trusted but maybe I am wrong?

Re Starlink: Is it possible to trace your route through a specific satellite and to look up the location of that satellite? That seems like a relatively easy and secure check (aside from the VPN/Proxy concerns which feel like they would be a larger challenge in this scenario since I am assuming the delays through the satellites would be more significant than delays through fiber.)

Re: Proof of location for online polls

#38

Post by vitus »

croshan wrote: post #16
38 wrote: post #10

Earlier quoted context omitted.

No you read it right. The proposal is idiotic and Will resulted in rural voters being detected as foreign residents

A bit aggressive. No, wouldn't connecting to a slow 3g tower affect ping times to all global servers proportionately? The proposal has other flaws, but phone to tower latency isn't one.

> No, wouldn't connecting to a slow 3g tower affect ping times to all global servers proportionately?

Yep. Per the article (last point under "How it works"):

> Users with a high latency to all servers can be excluded from polls, as this is a strong indicator of a VPN/proxy usage

Something seems off about how they're measuring latency (which seems to be "fetch various AWS Lambda endpoints"), since their system seems to think that I have hundreds of milliseconds of latency even to the nearest AWS region (even though in practice it should be an order of magnitude lower), and multiple seconds to the other side of the world.

edit: well, if the slowness is just on last-mile delivery, then it should be a fixed amount of overhead added to each connection (rather than a multiplier). For instance, I have about 8ms of latency added by my ISP just by the first hop into their network. But it's that same 8ms overhead whether I'm connecting to a server on the other side of town, or on the other side of the world.

Re: Proof of location for online polls

#40

Post by brian-armstrong »

Without a good amount of peering, this seems unlikely to work. There is really no guarantee about where traffic will exit a user ISP's network and enter the next. On average, sure, it may take a reasonably short path, but it might also travel halfway across the continent to traverse an IX.
Post reply on HN