Android：如何将密码/安全性添加到手机的时间/日期设置中以防止用户更改它
我的应用程序将在列表视图中显示“时钟”。当用户单击该项目时，它将从手机本身获取时间/日期并将该数据发送到服务器。我更喜欢这样做而不是使用服务器时间，因为如果他们没有信号/接收，他们将无法打卡。我想在时间/日期设置本身中添加密码安全性，这样用户将无法利用更改打卡时间。我怎样才能做到这一点？
谢谢
My app will have a 'clock in' in the listview. As a user will click that item it will grab the time/date from the phone itself and send that data out to the server. I prefer doing this over using server time since if they dont have a signal/reception they wont be able to clock in. I would like to add a password security to the time/date settings itself so the user wont be able to take advantage of changing the time when clocking in. How can I make that happen?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为你不能这样做，但你可以交叉检查时间。
当您“打卡”时，还将 /proc/uptime 作为文本文件打开并读取其中的值。我相信就在几秒钟之内。当您下班时，重新读取该值并使用差异作为交叉检查。如果服务器也可用，也请检查服务器的时间（或立即报告打卡时间）
如果电话崩溃或在其间断电，则正常运行时间的差异可能小于您通过普通时钟记录的时间。在这种情况下，正常运行时间的差异可能小于普通时钟（可能会是负值），因此如果您的打卡是在没有访问网络时间的情况下完成的，您的软件可能必须有一种方法将该特定结果报告为未经验证，并跟踪每个用户未经验证的数量，以便在数量过多时进行标记以供人工审核。
可以想象，用户可以编译并安装一个与正常运行时间有关的内核，但那个人也可能可以绕过您要做的大多数其他事情。
I don't think you can do that, but you can cross-check the time.
When you "clock in" also open /proc/uptime as a text file and read the value there. I believe it is in seconds. When you clock out, re-read the value and use the difference as a cross-check. If a server is also available, check the time from the server too (or report the clocking in immediately)
If the phone crashes or is powered off in between, the difference in uptime could be less than what you've recorded via the ordinary clock. In that case, the difference in uptime might be less than the ordinary clock (likely it will be negative) so if your clock-in was done without access to network time your software may have to have a way to report that particular result as unverified, and track the number of unverifieds per user to flag for human review if it becomes excessive.
A user could conceivably compile and install a kernel that lies about uptime, but that person could probably get around most of the other things you would do, too.
我建议只向服务器发送消息“用户 X 想打卡”。服务器将使用其当地时间进行“打卡”。这样您将完全忽略设备的时间，并更好地控制您的基础设施。
一般来说，如果您希望某些内容尽可能安全，请不要在客户端执行此操作（除非绝对必须这样做）。在这种情况下，用户可能会在他的设备上获得 root 权限，并使用一些命令行魔术来用虚假的日期/时间来愚弄您的服务器。这并不难。而且您将无法预测“时间保护”的所有明智解决方法。
I would suggest to just send message to server "user X wants to clock in". And server will use its local time for "clocking in". This way you will completely ignore device's time, and have more control over your infrastructure.
In general, if you want something to be as secure as possible, don't do this on the client side (unless you absolutely have to). And in this case user may gain root on his device and use some command line magic to fool you server with fake date/time. Its not that hard. And you just won't be able to predict all the smart workarounds of you "time protection".
您可以设置一个服务每分钟（左右）运行一次来检查时间。如果时间距离上次检查后不到 1 分钟，则可能已更改。此时您应该与服务器确认，以确保差异不是由重新启动手机引起的。
如果您发现时间已更改，您可以将其更改回来或将其记录在您的主应用程序中，并标记“用户”进行纪律处分。
You could set up a service to run every minute (or so) that checks the time. If the time is not ~1 minute after the last check then it may have been changed. You should confirm with the server at this point to make sure the discrepancy wasn't caused by rebooting the phone.
If you find that the time was changed, you can change it back or log this with your main application and flag the "user" for disciplinary actions.