title: Preventing user from manipulating the time that will be stored in the local database of Android?
body: <p>I'm trying to make an employee attendance app where the users (employees) could punch in when they come to the office. The details they punch-in will be sent to the server. The major focus in on the time. </p>
  
  <p>I am trying to implement offline functionality as well. (If the app doesn't detect internet connectivity, the punched-in record will be stored on the local db (SQLite) , and once it does, push the record from the db (and clear it) onto the server.</p>
  
  <p>I tried capturing the time using the <em>GregorianCalendar</em> class but the time values seem to be vulnerable to user manipulation. (Especially Scenario A)</p>
  
  <p><strong>Scenario A</strong></p>
  
  <p>A user could turn internet connectivity off,  turn <em>Automatic Data &amp; Time</em> off, manually set the time and then open the app to punch in.</p>
  
  <p><em>Example:</em> Mr. X comes to office at 8.45AM, turns airplane mode on, manually sets the device time (say 8.30AM) and then punches-in the record. The time value that he sets gets entered in the db instead of the actual time he came in.</p>
  
  <p>How do I prevent this from happening?</p>
  
  <p><strong>Scenario B</strong></p>
  
  <p>A user could just edit the local db values manually (rooted phones). [I know this is inevitable but any suggestions to make his harder?]</p>