I have a Java applet, which records the whole screen of the user and uploads the images to the server.
If one would be able to (and many people could, I know) falsify the screen recording they could cheat legitimate users of the system out of their money, so there are incentives.
I have been doing some reading on this topic and it seems like any attempt at client-side validation is pretty much useless ie. trusting the client is out of the question. Obfuscation and such only create an inconvenience to malicious users, not an obstacle.
This problem is partially solved by a feature I came up with, which enables the system to be sure that the recording is authentic up to a certain point. After that point in time, however, it becomes ambiguous again. After that point the hacker could overwrite my applet's functions and upload faked screenshots. Or he could switch monitors of his computer, where the new monitor has a fake, but identical-looking screen, open programs etc.
Somehow I need to be 99.9% sure that the recording is authentic.
So far I have come up with something like this: Log all upload times/rates of all screenshots of all users and then if someone is suspected of cheating, compare the upload rates to other users, especially before and after the potential "switch"/"overwrite", the underlying assumption being that overwriting the code slows down the application slightly or switching monitors creates some abnormal delay.
**The question is: is my theory valid? **