3

A part of the application that I am building should be accessed only during a particular time period.

I know we can get the current system time using the properties of DateTime in C#. If I use DateTime properties then the users can change their system time and access the part of application when ever they want.

Please let me know how to get the ACTUAL current time in C#.

Soner Gönül
  • 97,193
  • 102
  • 206
  • 364
rookie_developer
  • 1,359
  • 3
  • 15
  • 27
  • 8
    You need to pick a web service that you can trust. However, the user can still attack you using Fiddler. This is not actually possible. – SLaks Jan 16 '13 at 16:21
  • I assume you are going to have to use a web service of some sort for this, right? – Alan Jan 16 '13 at 16:21
  • Why this requirement? Are you trying to create a kind of licencing check? Or do you need a very precise date? please ellaborate. Answer won't be the same. And why don't let the user properly set its system time over a RTP server? – Steve B Jan 16 '13 at 16:22
  • 1
    What is time? What is actual time? These questions are very difficult to answer... But I think you want to connect to a network time (NTP) server... – ppeterka Jan 16 '13 at 16:22
  • 1
    @SLaks It would be possible with encryption surely? If the application generates a token passes that to the web service and the token was used in generating the response that would avoid replay attacks. – Martin Smith Jan 16 '13 at 16:23
  • You will need an internet connection, for sure. I made this once, it was pretty easy. Now I'm at work but I can check this out in 2.5 hours when I'm home. There are a bunch of servers where you can connect to check for time, and it was quite easy to do that. – HericDenis Jan 16 '13 at 16:23
  • @MartinSmith: no, Fiddler can act and translate Https requests. – Steve B Jan 16 '13 at 16:23
  • 3
    Everything is crackable, it just depends on how difficult you want to make it. – Alan Jan 16 '13 at 16:24
  • 1
    @MartinSmith: No; just decompile the application and remove the check entirely. – SLaks Jan 16 '13 at 16:24
  • @SLaks Exactly.. And you can obfuscate or do whatever to make that more difficult but it is always possible – Alan Jan 16 '13 at 16:24
  • @SteveB - But so what? To fake it you would need to know how to generate a response in the format expected by the application encrypted using a key you don't have access to. Essentially the same issue as activating software over the internet. You can make it difficult enough that most people can't or won't bother. – Martin Smith Jan 16 '13 at 16:25
  • You will have access to the key as it will be embedded somewhere in the app (maybe deeply, but it will be crackable eventually) – Steve B Jan 16 '13 at 16:29
  • @SteveB: Wrong; the app could have a public key that verifies an RSA signature generated by a private key on the server. However, you could still remove the check or replace it with your own keypair. – SLaks Jan 16 '13 at 16:32
  • it depends on what you are trying to do. Either tamper the date sent by the client app (with the public key), or alter a date received from the server (where you have to alter the public key to make the app believe its legitimate) – Steve B Jan 16 '13 at 16:46
  • 2
    We need to clarify who are these users in relation to the developer. Paying clients tend to get very ticked off about online licence checks and external NTP is often blocked at firewalls. So the relationship is important to establishing a good solution. – James Snell Jan 16 '13 at 17:50

4 Answers4

4

You can query an NTP server. NTP servers provide you with the current time, and allowing you to be very accurate (that's how computers synchronize clocks).

See an example here

Community
  • 1
  • 1
zmbq
  • 38,013
  • 14
  • 101
  • 171
2

You need to query some NTP servers to get the actual current time, such as www.pool.ntp.org

Federico Berasategui
  • 43,562
  • 11
  • 100
  • 154
2

Have a look at this implementation of NTP client: http://dotnet-snippets.com/dns/simple-network-time-ntp-protocol-client-SID571.aspx

Tommaso Belluzzo
  • 23,232
  • 8
  • 74
  • 98
0

If the system date is wrong, then your application has to get the correct date from somewhere else. That means and outside resource perhap a web service or other local remote server.

MethodMan
  • 18,625
  • 6
  • 34
  • 52