>
1. The Dark Art of Attendance Cheating
When you build a mobile application for normal consumers, you assume the user wants the app to work correctly. When you build an employee attendance tracking app, you must assume a certain percentage of users will actively try to deceive the system.
During my internship at CV Adisatya, I was tasked with engineering the core verification pipeline for Ceklok. Within the first week of beta testing, we observed almost every trick in the book:
- Using mock location apps to simulate being at the office while still in bed.
- Holding up a printed photograph of an employee in front of the camera.
- Sharing login credentials with a colleague who was already on-site.
Securing the pipeline required a layered defensive architecture.
Layer 1: Spoof-Proof Location Geofencing
Validating coordinates is not as simple as asking the GPS for latitude and longitude. Android allows developers to enable "Mock Locations" for testing, and dozens of third-party apps exploit this to spoof location data.
We integrated the Geolocator service with low-level platform checks:
- Detecting whether the location provider was flagged as mock by the OS.
- Cross-referencing GPS sensor updates with network cell tower triangulation.
- Enforcing a strict geofence radius around designated workplace coordinates. If the calculated Haversine distance exceeds the boundary by even five meters, the clock-in request is rejected.
Layer 2: On-Device Liveness Face Detection
To prevent photo-of-photo spoofing, we integrated Google ML Kit Vision on the mobile device.
Instead of taking a static snapshot and uploading it blindly, the camera feed runs continuous real-time face detection. The algorithm verifies facial landmark positions, eye contours, and head rotation angles. The user must blink or turn their head slightly to confirm physical presence before the photo artifact is captured and hashed.
Layer 3: Hardware Device Binding
The final piece of the puzzle was preventing credential sharing. During initial onboarding, the employee's account is cryptographically bound to their physical smartphone's unique hardware identifier.
If an employee tries to log into another phone, the system rejects the session and requires an administrator to reset the device binding.
What Security Engineering Taught Me
Building Ceklok taught me that security is not a single magical feature: it is defense in depth. Every check can theoretically be bypassed if someone is determined enough, but stacking multiple independent verification layers makes fraud too difficult and risky for casual abuse.