Location Spoofing: Benefits and drawbacks as a testing tool

Imagine you’re a mobile app developer living and working in Western Australia, then, once you recover from the shock, imagine also that you need to test an app location service in New South Wales. What you need is Location Spoofing! Maybe.

Location (or GPS) spoofing is where you trick your mobile device into thinking it is in a physical location other than its true location. If your app is one of the increasing number of apps with features that require the device’s current location–think weather apps, just-in-time promos, navigation–then you should consider adding location spoofing to your test suite.

Below I’ll do a whirlwind tour of the good and the bad of location spoofing to help you decide if you should use it, but first a few definitions are in order.

The What?

Location – typically refers to a latitude and longitude pair, and perhaps speed and altitude. This is typically made available to an app from a device’s GPS receiver, and can be used to derive other kinds of locations, such as suburb, city, and state.

Location precision – the location provided by a GPS receiver has an inherent precision (typically in the order of 5-10 metres), but this accuracy will only be available to an app if the user has granted the app permission to use precise location. An alternative provided by iOS and Android is to allow approximate location, which will ‘fudge’ this to be within hundreds of metres of the device’s true location. This affords enough information for some classes of feature (e.g., local news, weather, nearest store), without the attendant security concerns.

Geofence – is a virtual boundary placed around a geographic area. Geofences can be useful for defining real-world locations that have a special meaning to your app. iOS and Android have built-in features for monitoring entry and exit of geofences.'

The Good

Here are a few reasons why you should add location spoofing to your test suite.

Cost and availability

Sadly, travel budgets aren’t unlimited. If your app serves multiple locations, states, or even countries, then physically reaching each for testing may be prohibitively expensive, impractical, or both. The licence for a location spoofing application is going to be a fraction of the cost of travel to even just one location, let alone all, while spoofing locations can be used repeatedly to test in every required location. 

Reproducibility

In testing, it’s always good to verify your results, which is generally done through repeated runs of the same check, and reproduction of any noted issues. Spoofing lends itself well to this, as the software often requires, or allows, for precise placement of the intended location, either via a UI map or an address entry bar. Having a way to specify the same location for every iteration of the test will ensure tests can be repeated, and bug fixes verified. Some spoofing apps even allow creation of routes, which can be repeatedly traversed at given speeds.

The Bad

Ready to spoof your location? Here are some considerations that might temper your enthusiasm.

Cost and availability

Some of the best spoofing apps aren’t free, and whether or not the expense is worth it will depend on your situation. Apps that are free should be viewed with suspicion. It may be they’re monetised with adverts, but it may also be they’re designed to steal sensitive information. Avoid installing apps from sources other than the App Store or Play Store.

For iOS, this difficulty is compounded. Apple seems to shy away from apps that manipulate a device’s GPS reading, so finding these apps is a challenge in itself. Compared to the Play Store, Apple’s App Store has a smaller range of GPS location spoofing apps, all of which are paid-for apps and some of which have temporary, or limited-use licences. Finding them often requires knowing the app name beforehand (Adapptor currently uses UltPhone). The search function, whether by fault or design, isn’t super forthcoming for terms like ‘GPS spoofing’ or ‘fake location’. Your mileage may vary.

By contrast, searching for ‘mock GPS’ in the Play Store will return a few dozen results, most of them free and some, I assume, are perfectly safe to install. Sticking with those that are well-reviewed and have been around for some time is a safe bet, and the worst you’ll experience is having to sit through a few mandatory ads. That being said, even the best of these free apps will usually have their better, and sometimes vital, features–e.g., route tracing–locked behind a premium version.

Accuracy

A problem that most, if not all, location spoofing apps have, regardless of platform, is a tendency for imprecision and drift. While you may be able to place a pin on the exact pixel of the map you want to simulate, that doesn’t always mean that the app is going to be able to match it. For geofences the size of a public venue, such as a park or shopping centre, and for testing outcomes as general as ‘does it work at all,’ this kind of imprecision isn’t an obstacle. 

If instead you wanted to test the exact boundaries of that location, then you’ll likely find your results to be inconsistent, as the spoofing struggles to maintain the same location. This also extends to anything that requires the user to be on a particular landmark or terrain feature, such as apps that only accept submissions from users while they’re on or near a road. 

The Alternatives

Location spoofing on a real device isn’t the only way to put your location-based features through their paces. Below are a couple of other options.

Staging Environments

If you can’t get to a geofence, why not bring the geofence to you? In cases past where we required a physical test of geofences, moving the fences’ locations in a staging environment allowed us to test them without disrupting the user experience, or requiring spoofing. Of course, if geofences are ingested by your app from a backend, this requires that you either control the backend environments, or are able to liaise with the backend developers to configure test geofences.

While moving the fences may not replicate the circumstances of testing in the intended location perfectly, it does allow for physical testing without the complications of spoofing. This has the added benefit of being able to do repeated tests quickly to confirm consistent results. This makes it much easier to determine if the spoofing is working as it should be when later reconfirming the results via remote testing, or if physical testing can later be arranged at the intended site. 

Cloud-Based Testing

Rather than having a single physical device on which you spoof multiple locations via an installed app, cloud-based testing allows the use of virtual devices, hosted in the cloud and accessed remotely. A virtual device, and virtual testing environment, allows for cost-effective flexibility with the testing circumstances. Different device platforms or models, device conditions and settings, OS versions, and testing environments can all be setup via cloud-based testing without needing to purchase and set up the associated physical hardware. As it’s something that can simply be changed for the virtual device, the ‘location’ of the app doesn’t require GPS spoofing software to change. 

While this flexibility may save time and money in terms of hardware resources dedicated, it may also require new technical expertise to run efficiently. Most manual testers are unlikely to have the experience necessary to set up this kind of virtual hardware or environment, and may require the assistance of a developer to get it up and running. 

Conclusion

Testing on-site under real-world conditions will always be more reliable than any kind of remote testing; in the end, there’s no substitute for the real thing. But this isn’t always feasible, especially if the intended location is simply too far away from wherever you’re testing. While location spoofing does help in some scenarios and should be considered an option, it has drawbacks that can compromise test results, and there are alternatives if resources allow. Ultimately, your choice whether or not to use location spoofing will turn on the trade-off between how critical–and complex!–location-based features are to your app, and the overheads of setting up and maintaining spoofing-based tests.