How to Build a Proximity-Based Auth System that Defeats Fake GPS using WebRTC RTT

Elder Fernandes — Mon, 06 Apr 2026 13:49:41 +0000

The Problem: GPS is easy to spoof
We've all been there. You build a location-based system (for attendance, ticketing, or security), and within days, users find a "Fake GPS" app to bypass your geofencing. As a software engineer, I wanted a way to prove physical presence without relying on unstable satellite signals or easily spoofable coordinates.

The Solution: Network Topology & Latency (RTT)
Instead of asking "Where is this user?", I started asking "How close is this user to my gateway?".

By using WebRTC DataChannels, we can measure the Round-Trip Time (RTT) between a client and a local server. Since radio waves travel at a constant speed, a sub-5ms latency is a physical guarantee of proximity that no VPN or GPS spoofer can fake.

How it works (The Evolus Approach):
The Handshake: The client opens a Web-only interface (no app needed).

The Measurement: We establish a P2P connection via WebRTC.

The Fingerprint: We analyze the local network topology (Gateway fingerprints and BSSID neighbors).

The Score: Our orchestrator calculates a trust score. If the latency is ultra-low and the network environment matches, the presence is validated.

Why this matters for High-Concurrency Systems
When you are dealing with thousands of people at a stadium or a conference, 4G/5G becomes a bottleneck. By moving the authentication to the local network edge, we reduce external dependencies and speed up the validation process to milliseconds.

Finalize com um "Call to Action"
No final do post, adicione:

I’ve been implementing this logic into an orchestrator called Evolus. I just launched the v7.1 on Product Hunt and I'd love to get some technical feedback from this community!

Check it out here: hub.evolus.app.br

DEV Community: Elder Fernandes

How to Build a Proximity-Based Auth System that Defeats Fake GPS using WebRTC RTT