The latest articles on DEV Community by BunHead (@bunhead1978_ee831c3ffab2c). https://dev.to/bunhead1978_ee831c3ffab2c https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3880745%2F24641910-8c44-4abe-ace0-2720633b2fa9.jpg https://dev.to/bunhead1978_ee831c3ffab2c en BunHead Wed, 15 Apr 2026 15:20:01 +0000 https://dev.to/bunhead1978_ee831c3ffab2c/i-built-a-browser-based-proof-of-presence-tool-11gj https://dev.to/bunhead1978_ee831c3ffab2c/i-built-a-browser-based-proof-of-presence-tool-11gj <p>Six months of tinkering produced IRLid — two people meet, scan each other's QR codes, get a cryptographically signed receipt proving co-location within 12 metres. No app, no accounts, no biometrics, no central server. Just ECDSA P-256 and a bit of GPS, running entirely in the browser via Web Crypto API.</p> <h2> The 4am Bug </h2> <p>Shipped v3 last week. Thought it was done. Four hours later — every receipt showing 23% verified instead of 100%.</p> <p>Root cause: GPS coordinates were being stripped server-side before returning to the client. But the ECDSA signature was computed <em>with</em> those coordinates. Strip them → client can't recompute the original hash → signature check fails. Every. Single. Receipt.</p> <p>Obvious in hindsight. Not obvious at 4am.</p> <h2> The Deeper Lesson: Canonical Serialisation </h2> <p>Moved from JSON.stringify() to canonical() for payload hashing before ECDSA signing. JSON property order isn't guaranteed across environments — same object, different hash, broken signature.</p> <h2> New: Embeddable Widget </h2> <p>Any site can embed IRLid as a human-verification step — one iframe, postMessage API, no SDK. Think reCAPTCHA but you prove you've met a real human. Demo: <a href="https://irlid.co.uk/demo-login.html" rel="noopener noreferrer">https://irlid.co.uk/demo-login.html</a></p> <h2> Honest Limitations </h2> <p>GPS is self-reported. Cooperative trust model only — not proof-of-presence to a sceptical third party. Documented honestly in PROTOCOL.md on GitHub.</p> <p><a href="https://irlid.co.uk" rel="noopener noreferrer">https://irlid.co.uk</a></p> javascript security showdev webdev