Strategy for getting a "real" device time while offline

Question

We allow users to clock-in via our react native app.

We also allow offline clock-in by saving the GEO location and timestamp of the action and waiting for an active internet connection.

Is there a way to detect whether a clever user changed the time of the device while being offline and clocking in?

We thought we could start some interval when the app last contacted the server but is it the best option? I am not sure whether an interval would properly run when the app is in the background and such.

Answer 1

It's a bit tricky, instead of active checking you can do a passive checking for fraud clock-in cases.

You can run a background task which gets device time every hour or every 10 minutes and saves in a database table(say timelog_table).

Now if user changes device time and either goes in future! or in past! you will be able to see fluctuation in your timelog_table

now it's up to you that you want to process/analyse this timelog_table on device itself or on server side.

I would suggest to do it on server side, but here you will need to send this data to server.

Answer 2

Using Node.JS you can grab the system's uptime. See: https://nodejs.org/api/os.html#os_os_uptime

The script is os.uptime() and returns as an integer. If they modify their clock/date this number will still keep ticking properly. You can check the delta to see if they've changed their time (note: time-zone changes may still incur naturally). If they restart their device set their current time as your new baseline and continue checking for changes from there.

It doesn't prevent everything (as everything is not preventable) but sure does make it a lot harder to bypass, assuming they can figure out what your blackbox is doing.

---

Note:

Module: const os = require('os');

---

Ex Usage:

console.log(require('os').uptime())

Answer 3

I have found the following Gist which returns the number of seconds since the device booted.

With this NPM module which is based on the Gist I'm doing the following:

1. Upon server response: I save the server time along with the OS ticks
2. User checks in while offline: save the OS ticks
3. Connection is restored: send the calculated date from the ticks diff

The only pitfall is being unable to detect the "true" time of a device which was restarted while offline. However, our PM might just decide to block offline check-ins for this scenario.

Answer 4

You can take Albert's answer and add another hook.

You can track the time with interval and see the changes.

Something like https://stackoverflow.com/a/3367542/2938073

The only set-back here is mobile OS's usually limit background activity...

Answer 5

If you just wanna get a "hard to fraud time":

  var now = +new Date(); // or contact server

  setInterval(() => now += 1000, 1000);

 // Somewhen:
 console.log(new Date(now));