Question

Maybe someone here had already done this before – I’m not sure how to solve this safely…
My client want a kind of in-app-purchase for an Android application. But that’s only subsidiary – my problem is: there should be a kind of “rental” system. That means someone buys i.e. an item for a certain timeframe (i.e. 10 days). The App is only online when he buys that item – so I need a safe way to let this item expire offline after 10 days. If I use the internal clock, there are to much ways to manipulate this.

Any advice how I can accomplish this (relative) safely?

Thank you,

Answer 1

As it is run from an “almost always connected device” you could use an external source for checking the time ( and check it each time it use the rented item or periodically if you find it inconvenient),
It is how it is mostly done, and instead of relying on timestamp it relies on certificate that should be checked against a certificate server and is harder to tamper with.