How to retrieve time from the internet (bypassing PC clock)?

Question

For my MFC/C++ unmanaged time-limited software needs, I'd like to get a GMT/UTC time-stamp from the internet (instead of relying on the PC clock time that can be easily changed).

I already though about parsing the line "Current UTC"... line from http://www.timeanddate.com/worldclock/ (I think port 80 is more likely to be open than others) but I don't know how reliable this URL is...

Please share with me your pros/cons or different ideas on this.

Fawkes

What if the person blocks access to the internet for your app with their software firewall? – Savadove

and hacker can write software to emulate service with time – Vaughnvaught

Yep, a simple entry in /etc/hosts to redirect requests to timeanddate.com to a server under my control, which I configure to return whatever time I would have changed the PC clock to. Job done. – Vaporization

If you must get time/date, use pool.ntp.org as designed please. – Devoted

Well, I'll try to use gbjbaanb's suggestion below. – Fawkes

And codaddict's suggestion as well. – Fawkes

If you need is to detect cases where the time is changed by the user (in most case, changed backward), the trick is to keep a log of the most recent date/time, or another way is to check the date/time of Windows files that are changed on a daily basis such as event logs. – Relevance

Answer 1

Looks feasible and this is widely done.

Scraping of timeanddate.com can break if the site decides to change its HTML. Even a slight change in the HTML can break your scraper.

I would suggest you use a web service like earthtools. You'll have to pass the necessary arguments(latitude and longitude etc) in the URL and the response is XML which you can easily parse.

Progestin

This is very cool! I wasn't aware of earthtools. since I'm looking for UTC then giving 0,0 for long/lat would be sufficient for me and the parsing of XML is easy. But how reliable is this service? How do I know THIS URL won't break in a while? – Fawkes

(*) It says I need 15 reputation points to raise your vote.. so I would if I could.. Thanks. – Fawkes

Looks like earthtools moved to this link new.earthtools.org/webservices.htm – Relevance

Answer 2

Use a SNTP (Simple Network Time Protocol) to get the time from an internet atomic clock.

There's a few libraries available on the web - here's one for MFC on codeproject.

Oyler

Thanks, I'm aware of SNTP, but I thought that port 80 will be less blocked than port 123. That's why I aimed for a port 80 solution. Anyways, I'll give this one a try. Thanks. – Fawkes

Answer 3

Make your program better instead of wasting time trying to protect it. Any such protection that you can do will be circumvented easily. If you insist, you can run the software on your server, as this is the only way to actually enforce such limits.

Lunik

Thanks, but I cannot run it on the server. – Fawkes

What if its not for protection? What if someone wants to make programs for a device(ex: Raspberry PI) that doesn't have an internal clock, but has internet access. Yeah I get it that here that's not the case.. but we should think about the other side too – Warmth

Answer 4

Well, To conclude: My app contains an offline database that is updated once a day from the intranet.
I'd like to shred this database if it was not updated over a week and that's why I'd like to try and reduce the possibility of someone just changing the PC clock backwards.
I am fully aware of the fact that there are power users that could block my app from getting internet time in 20 different ways, but I'm trying to do the best I can in software (a hardware solution, e.g. a dongle, is an overkill for me).

Since I want to have a port 80 solution, I'll adopt codaddict's solution (earthtools) and will sample the PC clock otherwise.

Thanks for all the replies!

Fawkes

Answer 5

Hmmm. Interesting. You are basicly trying to use the Internet as a dongle.

If you truly need this kind of "protection" over your software, you should perhaps consider getting a true dongle with a real-time clock in it, like HASP. Of course either soltion is going to be trivial to get around for a decent hacker with a disassembler.

Generally I think it is better to open your software up and try to live off of fixes, mods, and support.

Carboy

Thanks, but a dongle is an overkill. I'd like some data to be protected, I'd like to protect it as much as I can via software, but it won't be a disaster if I won't make it. I'm trying to do this one in order to expand my programming horizons. – Fawkes

Answer 6

The answer lays within your question... Go to https://www.timeanddate.com/ and look for "API", you will find this page: https://www.timeanddate.com/services/api/ Detailed instructions: https://services.timeanddate.com/api/packages/time.html Using their API you send a request and receive an XML or JSON response. It cost you $150 per year but that's the professional way of doing it and since your purpose it to charge money for your software it makes sense.

Relevance

Any time you recommend a paid solution, you must disclose whether you have any affiliation with that product. – Speaks

I just found them on the internet so the answer is NO. I am not. I haven't tried them yet and we planning to try. – Relevance

I wrote nowhere that I plan on charging money for my software, and I don't post questions in search of a 3rd party solution. The answer you wrote on the question thread was far better and to the point (not that the software exists anymore). – Fawkes

Answer 7

National Institute of Standards and Technology (NIST) Internet Time Servers

References https://www.nist.gov/pml/time-and-frequency-division/time-distribution/internet-time-service-its

https://tf.nist.gov/tf-cgi/servers.cgi

Donalddonaldson

While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review – Proportioned