Question

My app will have a ‘clock in’ in the listview. As a user will click that item it will grab the time/date from the phone itself and send that data out to the server. I prefer doing this over using server time since if they dont have a signal/reception they wont be able to clock in. I would like to add a password security to the time/date settings itself so the user wont be able to take advantage of changing the time when clocking in. How can I make that happen?

Thanks

Answer 1

I would suggest to just send message to server “user X wants to clock in”. And server will use its local time for “clocking in”. This way you will completely ignore device’s time, and have more control over your infrastructure.

In general, if you want something to be as secure as possible, don’t do this on the client side (unless you absolutely have to). And in this case user may gain root on his device and use some command line magic to fool you server with fake date/time. Its not that hard. And you just won’t be able to predict all the smart workarounds of you “time protection”.