Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proof of location for online polls

ip-vote.com

Post reply on HN
Print view View original

21–30 of 89 posts

Re: Proof of location for online polls

#21

Post by raggi »

anilr wrote: post #4

Has this been tested, or is it just an idea. I imagine it would have some very serious limitations. Perhaps it could tell if you are likely in the US or Europe, but I doubt could get much more granular than that. Starlink internet customers, and users of Apple's private relay (vpn-like service) would all be excluded?

Tailscale uses latency to pick home DERPs and I am re-evaluating it as we observe what appear to be manipulated STUN latencies for users in Asia particularly in or close to China. The latencies are often raised to over 300ms to affect this, and steer clients toward the US west coast. The reason for these manipulations is unclear, but it's easy to speculate.

Re: Proof of location for online polls

#22

Post by c-riq »

anilr wrote: post #4

Has this been tested, or is it just an idea. I imagine it would have some very serious limitations. Perhaps it could tell if you are likely in the US or Europe, but I doubt could get much more granular than that. Starlink internet customers, and users of Apple's private relay (vpn-like service) would all be excluded?

I tested it from my home and got a radius of about 200 km. But would be nice to get some additional validation. In any case it's not super precise but it adds more friction to manipulation and in conjunction with IP based geolocation and other things it may turn out to be useful for some parts of an online democracy.

Re: Proof of location for online polls

#23

Post by mulmen »

raggi wrote: post #21
anilr wrote: post #4

Has this been tested, or is it just an idea. I imagine it would have some very serious limitations. Perhaps it could tell if you are likely in the US or Europe, but I doubt could get much more granular than that. Starlink internet customers, and users of Apple's private relay (vpn-like service) would all be excluded?

Tailscale uses latency to pick home DERPs and I am re-evaluating it as we observe what appear to be manipulated STUN latencies for users in Asia particularly in or close to China. The latencies are often raised to over 300ms to affect this, and steer clients toward the US west coast. The reason for these manipulations is unclear, but it's easy to speculate.

> The reason for these manipulations is unclear, but it's easy to speculate.

Care to elaborate? I don’t know why anyone would do this.

Re: Proof of location for online polls

#26

Post by DeepYogurt »

c-riq wrote: post #12
jawiggins wrote: post #2

> Latency-based geolocation can help protect poll integrity by: > Detecting when poll responses originate from outside the intended geographic region > Identifying attempts to manipulate polls through elevated VPN/proxy usage Unless the user also needs to complete a reaction-time test, couldn't this be defeated by using a remote desktop connection to a machine that is physically located in the other geography? It jus…

That is true, the location proof is only for the hardware whose IP is used for submitting the vote request. However if remote desktop provider / cloud provider / VPN / Tor IPs are already blocked by the voting platform. Then it would require significant effort to acquire hardware in the target geographic region and equip it with a residential IP. Generally the whole setup only makes sense if IP's (or IP ranges) can o…

For a motivated attacker its not that hard to add a few thousand raspberry pis to a residential internet network in most countries. Its really a quite practical attack when the stakes are governmental control.

Re: Proof of location for online polls

#28

Post by reocha »

mac3n wrote: post #14

having worked on IP geolocation in the past, I don't think this works. Though it can do a pretty good job of getting you in the right continent. * Not all traffic goes through fiber - there are microwave links operating closer to the speed of light, though these are mostly reserved for high-speed trading. There's also satellite connections, but as long as they don't do satellite-staellite, they're slower. * There are…

I think routing not being shortest path (nor being consistent) is the biggest issue with this method.

Re: Proof of location for online polls

#29

Post by 85392_school »

comex wrote: post #13
polon wrote: post #5

Earlier quoted context omitted.

I think this is covered on the page "Successfully manipulating a poll which employs this method would require following efforts and resources: Gaining control over a large number of devices in the target geographic region for submitting votes through those devices" So yes, it seems like it can be defeated via a remote desktop (or any proxy in the allowed area)

You don’t even need to gain control over a large number of devices in the region. You just need _one_ device in the region, which can connect to the VPN or proxy service you were already using (the assumption seems to be that the attacker has a large number of IPs they can access through such a service). That device will get some added latency from going through the VPN/proxy, but because it’s physically close, the a…

If you're using a proxy, I don't think whether or not the source device is in the region changes anything. The only variance is in the time from where traffic exits the proxy to servers.

Re: Proof of location for online polls

#30

Post by kvdveer »

c-riq wrote: post #12
jawiggins wrote: post #2

> Latency-based geolocation can help protect poll integrity by: > Detecting when poll responses originate from outside the intended geographic region > Identifying attempts to manipulate polls through elevated VPN/proxy usage Unless the user also needs to complete a reaction-time test, couldn't this be defeated by using a remote desktop connection to a machine that is physically located in the other geography? It jus…

That is true, the location proof is only for the hardware whose IP is used for submitting the vote request. However if remote desktop provider / cloud provider / VPN / Tor IPs are already blocked by the voting platform. Then it would require significant effort to acquire hardware in the target geographic region and equip it with a residential IP. Generally the whole setup only makes sense if IP's (or IP ranges) can o…

No need for lots compromised devices. Just a single device (probably doesn't need to be compromised) in IPv4 behind carrier grade NAT is typically enough to vary your IP, or plausibly reuse an IP.
Post reply on HN