So, I want to set up a Daily Rewards system, where the user is rewarded with 1000 coins every 24 hours. How would I tell time to do this? If I took the time, I could set it as a playerprefs value. Then the next time the user logs on, i could get the time, subtract it from the original time, and see if it is greater than or equal to 24 hours, correct?
The only problem with this is that people could change their device time ahead by 24 hours and then log back onto the game to get the daily rewards. How do I prevent against time-changing users to still get an accurate daily-rewards system every 24 hours?
You need to poll a trusted source, like a website/service - set up a server page that only you can modify that sends the time encoded in xml or something back to the app. deserialize this on the device.
Never trust the actual device time epseically if it involves rewards/money that people want to get.
True, taking time from the local device is not a good idea since it can be exploited by pretty much everyone.
However, you could ask time from a remote server such as time.windows.com This way you could check if 24 hours has already passed regardless of the timezone your player is in.
Just keep in mind, you’ll always have to store a value when you last got the bonus and if that’s on the client, it can be changed as well.
Easy-ish way that would discourage the vast vast majority would be to encrypt the last time in playerprefs, and poll a time server for a time. They’d either have to decompile your game to check the encrypting and apply it, or do a man in the middle attack. Both probably take more effort then people can be arsed to do. Assuming your app isn’t popular enough that they’d make programs to do it for them.
Zuntatos raises a very good point too. The most secure way, but also the most annoying, would be to do all the reward logic on the server and just have the client poll to see if any rewards are available. This will require a lot of setup and cost, especially if your game becomes popular.
It really depends on the goal of how much people getting more bonuses is tolerable. If it’s 1%, going by device clock may be fine. If it’s 0.1%, saving it in playerprefs and polling a time server may be fine. If it’s 0.01% you may do some simple obfuscation over the playerpref, without reaching the limits of what apple allows[1] as encryption. Setting it as a string with some silly encoding may work; you can shift the char values by some x; you can swap around characters. If it’s even less, then you’ll probably want to go for the external server; but Apple’s policy seems to disallow any encrypted network so you’d be back at that.
These number are obviously wild guesses, and I’m not a lawyer nor do I have knowledge of Apple’s encryption policy.
