Hacker News Reader

Pretty trivial to route your request through an IP address in the same city as the victim.

Possible, but not exactly trivial to do the same with an IP address in the same city and from the same ASN as the impersonation victim.

There are definitely some mitigations you can do servers use to reduce the likelihood of success of this kind of attack.

Now I want to go build an auth system. :D

How would mobile networks fair with something like this if youre moving around?

Plenty of webapps already do this. You'll usually get asked to re-login or to provide a 2fa code to proceed. Very annoying when you hop between networks often.

Reply on news.ycombinator.com