How to detect if my website is relayed through the hosts file or an application

Question

I have an application that connect to my website to verify user data (hardware id), but if somebody puts a line in the windows hosts file, it could be relayed to another site. Then it gets bad data and my app gets cheated (cracked).

So, how to detect if my website is relayed through the hosts file or another application?

Answer 1

Could you cryptograhpically sign the data (perhaps salted per client)? The client can have the public key, and you can use that (safely) to prove that the data came from your server.

Answer 2

Use SSL and refuse to operate with an invalid client certificate. That way a request faked through hosts (or any other way to redirect where you connect to) won't pass, a proxy can't see it, and a proxy playing man-in-the-middle with the certificate won't be accepted (think of how when you use Fiddler to debug HTTPS traffic you get the "do you trust" message on your browser; your application will be doing the equivalent of saying "no, I don't").