A method of using a computer to generate a security token for a client of a reputation system, comprising: receiving a registration request from the client of the reputation system; observing metadata about the client; selecting observed metadata about the client for use in a security token, wherein the selected metadata comprise metadata about physical properties of the client; generating the security token for the client, the security token derived from the selected metadata; providing the security token to the client, wherein the client is adapted to use the security token to authenticate the client; conducting a transaction with the client, the transaction comprising receiving the security token from the client; observing metadata about the client during the transaction; extracting the metadata about physical properties of the client and a geographic region associated with the client from the received security token; determining whether the extracted metadata indicate that the client is potentially mobile; observing an IP address used by the client during the transaction; determining a geographic region associated with the observed IP address; correlating the geographic region associated with the observed IP address with the geographic region associated with the client to determine a degree of correlation; and applying a security policy to the client determined responsive to the degree of correlation and whether the extracted metadata indicate that the client is potentially mobile, wherein the applied security policy trusts a report received from the client if the degree of correlation is lacking and the extracted metadata indicate that the client is potentially mobile. receiving a registration request from the client of the reputation system; observing metadata about the client; selecting observed metadata about the client for use in a security token, wherein the selected metadata comprise metadata about physical properties of the client; generating the security token for the client, the security token derived from the selected metadata; providing the security token to the client, wherein the client is adapted to use the security token to authenticate the client; conducting a transaction with the client, the transaction comprising receiving the security token from the client; observing metadata about the client during the transaction; extracting the metadata about physical properties of the client and a geographic region associated with the client from the received security token; determining whether the extracted metadata indicate that the client is potentially mobile; observing an IP address used by the client during the transaction; determining a geographic region associated with the observed IP address; correlating the geographic region associated with the observed IP address with the geographic region associated with the client to determine a degree of correlation; and applying a security policy to the client determined responsive to the degree of correlation and whether the extracted metadata indicate that the client is potentially mobile, wherein the applied security policy trusts a report received from the client if the degree of correlation is lacking and the extracted metadata indicate that the client is potentially mobile.