Good question. I still think that its up to user to decide what data he shares with app. If its crucial for app to know that gps position is not faked, app could do some heuristic. Check if user is not moving faster than some limit, does not stop moving for extended periods of time etc. Basically anticheat engine. Only area where this whould be relevant i think is online multiplayer games. Otherwise, if user is faking gps he is messing up his own experience.

2 different permissions: Possible faked GPS data, and Not faked GPS data. An app would really need to explain why it can't accept possibly faked GPS data.

https://developer.android.com/guide/topics/sensors/gnss on android now apps can access the raw gps data, which is much harder to fake

I like that idea, although to me that is kinda the status quo and I'm not sure the folks who want to be able to fake anything at will would be ok with that.

>Only area where this whould be relevant i think is online multiplayer games.

That's the issue with augmented reality games like Pokemon Go.

i argue it's not an issue. If the user decides to spoof to cheat in the game, there are other ways to detect it (such as speed limiting - which, as i understand, pokemon go already does).

If the app wants to force a user to not modify their phone just so they have a secure enclave for which they can implement DRM, then i can't agree to it. This includes things like spoofing, but also things like memory edits or hacking save files, or anything else client side. If the app needs secure storage that's unchangeable, they can save it on their servers.

Spoofing is an issue even if you limit yourself to a reasonable speed. You don't have to spoof yourself everywhere all at once.

I don't play Pokémon go, but with my understanding of the game I'm not sure how spoofing the GPS would impact other users in a negative way.

Considering that most of the world has some form of travel restrictions over the past year, and I believe that being able to interact with friends in the game requires you be be in very close proximity. Can you explain how spoofing GPS data so that people are allowed to play together even though they are not close is bad?

>I'm not sure how spoofing the GPS would impact other users in a negative way.

You could attack a pokemon gym at your convenience (from your couch, whatever time of the day). This negatively impacts other players because a legit, non-cheating spoofer will have to expend far more effort to do the same thing.

>Can you explain how spoofing GPS data so that people are allowed to play together even though they are not close is bad?

Friend interaction or just interaction in the game has to do with raiding and trading. You can already league battle (pvp) over any distance.

Niantic has made some changes along these lines - main one is the remote raid pass. One person close enough to a gym can invite friends to raid, no spoofing needed. They also upped the trade distance, how close you need to be to interact with a gym/pokestop, etc.

So the answer to your question is the game itself has made changes to address actual in-game scenarios. That leaves spoofing GPS as a way to asymmetrically cheat against gyms, or perhaps trivialize collecting pokemon (some are region locked and so on).

In games like Pokemon Go (and similar augmented reality games) players go to real world locations in order to gather resources, and battle the pokemon of another user who currently holds that position.

If you can just spoof, the whole nature of augmented reality falls apart and someone could simply spoof themselves anywhere and take those positions. It was a big problem before the android os made it harder to spoof.

There's no point/ fun in playing augmented reality games if enough people simply cheat and the real world limitations aren't a factor.

I played pokemon go seriously for a few years (both at the beginning and recently) and honestly spoofers are an issue only because imho Niantic is incompetent and doesn't care.[1]

not to say how it you are anywhere not in a medium size city you need either spoofers or endless grind to unlock significant parts of the game

[1] to be fair I left before the pandemic, so I cannot comment on how they handled that

I think spoofing early on was an issue because it was so easy.

It really stopped being a large scale issue after Android started making it harder to spoof.