By easy I mean easy to implement in code.

By reliable I mean that it doesn't depend sources who might fail under which there is no good control.

By secure I mean that it cannot be worked around or that if it could be worked around it would be pretty complicated.

The best solution I can think about for the moment is trying to check that the user has automatic date and hour and automatic time zone enabled. I thought this could be worked around by enabling flight mode, or maybe some other option, but at least in my smartphone, it returns to correct date. Guess there are some things about getting the date in phones I don't understand, anyway I can't be sure this works for all smartphones.

I know about other methods like using some NTP server, but I think this would add unnecesary complexity and less reliability.

I'd like to hear suggestions about which would be a good way to do this.

PS: I'm editing per request.

My app allows to make a certain action in the app only once per week.

It's not something that important what happens if the user manages to trick the app into making it believe that's another date, I don't really care much about maybe a 5% of users tricking the app to believe it's another date, but for this to happen at least all trivial ways in which the date retrieval could be worked around shouldn't be allowed.

  • What actual problem are you trying to solve here? But in general, once someone has physical control of the hardware, you can't trust anything from that hardware. – Philip Kendall Sep 10 '17 at 14:45
  • I'm trying to detect that the date set in the phone is the same date there's in reality, sure, someone who has high technical knowledge might be able to trick an App that makes the check into accepting a false date, but I think that for the common user, it would be enough with the solution I've proposed (checking date, hour in time zone) if date sets to correct whatever the case if their options to have them automatic are enabled. – Jesús Gómez Sep 10 '17 at 14:49
  • 1
    Please give some more context. Why and how much does this matter? If it's that important why trust the client? – jonrsharpe Sep 10 '17 at 15:16
  • 1
    Secure what against what? You can't ask us to design and evaluate a security design in a vacuum. A cereal box will secure a bag of cheerios against gravity but it won't secure a wad cash from the baby sitter. – candied_orange Sep 10 '17 at 15:29
  • 1
    The simplest way is to make the app connect to a server to take the action. You're in control of the server and its time, unlike the client device. – jonrsharpe Sep 10 '17 at 17:23

How can your app know that the phone uses the real date and that it was not tampered with ?

  1. Look for an authoritative source, like an NTP server, hoping that the user has not the skills and equipment to hijack your NTP request

  2. Look around to other sources to see if they have the same date than you:

    • For example, you could use the GPS time, and check if it's compatible with the date. I'm not sure of how to get the GPS time on android, but GnssClock seems a good start, to look for. I imagine that method getFullBiasNanos() in particular could help. The good thing is that it's very difficult to hijack a GPS signal.
    • Query a popular news site to compare if dates are compatible (but then, you'd better go to an NTP server directly).
  3. Make your own consistency check, by logging every hour the date and time in UTC and comparing the current UTC time, with the previous time. This ensures that the user cannot back-date his device. If you can do this and compare the difference to a timer that measures the elapsed time between the two events, it would even be more useful. But honestly, if you fear that the user light tamper the system, he might tamper the log, so you need to encrypt it. This again is at least as complex as querying an NTP server.

  • 1
    If the phone has been tampered with, you don't need to hijack the GPS signal, you could just hijack the GnssClock library. – Jörg W Mittag Sep 10 '17 at 20:04
  • @JörgWMittag true! But I think that the risk is lower, as the gps signal is not the usual source of true time. Anyway, you could check the validity of the library's signature. – Christophe Sep 10 '17 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.