NOTE: program in java, server uses php, and mysql…file is .log or .txt file
I have a program which takes the last line from a txt file and sends it via HTTP request to a server. The file is written by an external program, but the user is be able to open it an modify it.
The lines are in this format, and the time will be in the local computer time.
[hh:mm:ss] Message
If I consider that the time in the (real) message IS the time in the computer can I use it to verify the freshness and validity by comparing with a time in a fix location? (server time, gtm time, etc)
The users could be anywhere around the world, and I cannot guarantee that the time in the local machine is exact. My idea would be to start the program and check for time on machine, and compare it to my external time. then somehow manage to make sure that the message was not done by the user….for example message should have to be 20s~ computer time and time in computer should be synchronized with external time.
Never done something like this, but really interested.
(I know there will never be a hacker proof program, but would like to make it as hard as possible)
Thanks, I will add details in the afternoon if needed.
Two options for Time Issue:
If you can modify the program that creates the file, always use a fixed timezone to write the time. This will ensure the time is accurate across all timezones.
OR you can write the timezone along with the time and compute accordingly at server side.
Regarding User Tampering the data:
I suggest you generate a MD5 hash of the message and send it along. Then compute the MD5 from message contents again at server side. If the hash does not match the MD5 passed to server, it means the user has tampered the data.