When Apple first released iTunes rentals, there was a bug where users could change their system time to extent the rental period. See this article. Soon, Apple fixed the problem.

When implementing a time bomb style feature, how can one ensure the program/file will expire? Apple somehow manages to lock users from a file without using the system clock or connecting to the internet. Thoughts?

  • the specific nature and implementation of Apples DRM is largely unknown. There are a number of ways you can record the passage of time, perhaps by updating a file every 24 hours on the clock, regardless of any particular relationship between yesterday and today (so changing the clock wouldn't defeat it, it would still know you had had it for 14 days, even if your system clock was set back months or years). that means there would be a trace somewhere on your PC, that could theoretically be manipulated, but they likely made that very difficult. – Frank Thomas Jul 10 '14 at 14:18
  • The biggest flaw with the method they were using was having one end open. To fix that would be to just close off both ends of the time, create a |24hour window|, anything that falls outside of that 24hour window then fails to meet the criteria. The large changes people were making would no longer work. We can be sure that after the news of it it they covered more than that, and probably included a secondary testing. – Psycogeek Jul 10 '14 at 16:29

As @Frank Thomas notes, how Apple does it is no doubt considered a trade secret. How you might do it, or how I might do it, is more open to discussion.

I would probably have my software keep track, somewhere, of time passing on the system clock - not what time/date the system clock says it is, but simply the passage of time, and record that (encrypted) in several locations. When I started up I'd check to see if all the locations agreed, and if they did not, I'd set them all to the highest value in any location, before proceeding to increment from there.

I can see potential flaws in this approach (possibility of missing time while computer is off), but something like that would, to some extent, work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.