4 ms·
Important: Although the sample application is a working example of how you can implement in-app billing, we strongly recommend that you modify and obfuscate the
by micampe 16y ago
Important: Although the sample application is a working example of how you can implement in-app billing, we strongly recommend that you modify and obfuscate the sample code before you use it in a production application.
uhm? is the security left to code on the device alone?
- rst 16y agoThis is probably intended as an (inevitably partial) defense against people copying application .APK files and their associated data between devices, or altering the .APKs to be able to get stuff without paying for it. Here's a discussion of the issue in the context of their licensing verification library: http://android-developers.blogspot.com/2010/09/securing-android-lvl-applications.html http://android-developers.blogspot.com/2010/09/securing-andr... I'm not sure that precisely the same threat model applies, but they may be thinking "better safe than sorry" regardless.
- micampe 16y agohaven't read that article yet, but my point is that if Google is acting as a payment gateway, they should probably provide some means to verify purchases with the server, not tell you to obfuscate your code to prevent people from reverse engineering the keys and algorithms.
- rst 16y agoThat's how their licensing verification stuff works. The problem is that someone could copy your app's code (the .APK file) and alter it to not communicate with the server, or ignore its response. There's nothing the licensing code or library can do once it the attacker has gone in and disabled it; their main suggested defense, for now, is obfuscating the code so that alteration is hard to do.