My friend wants to email a certain file to another person, and allow that person to use the file for 30 days, after which it will automatically delete itself. Is this even possible?

  • For an unencrypted file, definitely not. For a file that is encrypted and requires a specific application to use it, then it's possible: this is exactly what happens with BBC Radio Player (now BBC Sounds) when you down-load a programme for later listening. The file doesn't delete itself, but is deleted by the application the next time it or any copy is used after the 30 day expiry. So it's possible, but definitely not easy. – AFH Sep 20 '19 at 10:29
  • 1
    What are you really trying to protect though. If it's the content of the file, then what's to stop them from copying that or manually entering it into another file or copying it. Someone could also save screen shots of the file's content as well. Curious to know what you are trying to protect or prevent from being accessed within the file after the 30 days because it may be a moot point for the ultimate goal even with the file you send being self-destructed. – Pillsbury IT Doughboy Sep 20 '19 at 10:45

In short, no.

A file cannot be actionable in itself. It opens into an app, which does all the work, so to delete it you would need complicity from that remote operating system or a specific app, which is not going to happen.

Secondly, it is trivial to make copies of any file, so even if you could circumvent the first hurdle, the second will stop you.

  • it is trivial to make copies of any file ... and of its content (for example, if it is some text, then simple PrintScreen -> OCR, and the text is unsecured). – Akina Sep 20 '19 at 11:10
  • Sure - I thought that the triviality of such a task meant I didn't really need to spell it out in full. The first paragraph is going to be a big-enough hurdle, persuading the OS or an app to conform to that expectation in the first place. It's like print-protecting a pdf… just open it in an app that doesn't care about the flag. – Tetsujin Sep 20 '19 at 11:15
  • You're right. Just for some reason everyone is talking about the file itself, while the OP really wants to defend not the file itself but its content. – Akina Sep 20 '19 at 11:18

This really is impossible:

  • If the file is not an executable of some kind, it doesn't have the means to delete anything.

  • If the file is an executable, it still can not come with its own time reference (a time reference being hardware, such as a RTC or GPS reciever or similar). So to even know that the 30 days are over, it has to rely on the OS (which is out of the control of the person supplying the file). So by just resetting the clock, those 30 days will appear to never expire.

  • It can use online services, of course (either purpose-built systems or generic freely available time-stamping services). – user1686 Sep 20 '19 at 11:51
  • @grawity You can't. The OS of the user (not the supplier) of the file is outside your control, so you have no way to force it to use such a service. – Eugen Rieck Sep 21 '19 at 9:15

The only way to accomplish this is by storing the file onto a container that can self-destruct.

But keep in mind, even the best people are unsuccessful in achieving this. Everything can be bypassed, which turns this into a security by obscurity. You don't tell the end-user the file will not work after 30 days so they don't look for a way to break it, and then break it after 30 days. This is of course really not-done and will not make you friends. This also means it will work once, but once the word is out, it won't work a second time.

Once people know there is something in place to prevent usage after 30 days, it becomes a matter of the chicken and the egg. Are you better at providing security or are they better at cracking? In any case, you will move to an encryption of some sort by this stage, which already invalidates the answer to this question.

You would need to have something that the user executes that is otherwise encrypted, and have the time-limit build in. After the time expires it would stop it from using. Given that local clocks can be defeated, you would need to rely on an online time source. This means your protection requires always-online, and if you go this far, it is most likely the better solution to create something online that views whatever it is you want to share, and control everything server-side. They have a link to your goods, and that link will simply expire.

Keep in mind, that browsers have cache, and anyone can "copy" anything they see on the screen, so if you need to copy/protect as well, you will need to include watermarks.

So basically, you are talking about DRM.

Not the answer you're looking for? Browse other questions tagged or ask your own question.