[michaelt]

The vast majority of consumer GPS receivers take their clock from a quartz crystal. The accuracy will be somewhere between 10 parts per million (ppm) and 30 ppm. 5-15 minutes per year of drift - sounds pretty precise, right?

Except when you're measuring the time of flight of signals going close to the speed of light, 10ppm of clock slew gives you 3,000 m/s of clock slew.

That's why GPS receivers actually need to see 4 satellites to get an accurate fix; receivers actually calculate position in four dimensions - x, y, z and time.

Anyway, consequences:

1. The GPS receiver in your phone doesn't have an 'extremely high precision clock' by the standards of high precision clocks.

2. You could mount a replay attack against a receiver introducing error at up to 3km per second in such a way that it won't be readily detectable over other errors in the system.

3. Due to practical issues involved with such a replay attack, it'd probably be possible to crash a drone or misdirect it by a few hundred meters; but incredibly difficult to misdirect it to a distant country or anything like that.