Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example how it can be done? I don`t know, but this would be quite common task related not to Android, but to other apps also.

share|improve this question
5  
I'm going to disagree with the Android documentation. Any effort spent protecting your public key is a waste. If you are using your public key in a way that requires protecting your public key, they you are using it incorrectly. –  this.josh Jul 23 '11 at 5:38

1 Answer 1

up vote 7 down vote accepted

This may sound mysterious, but once you understand the threat model that they're talking about, it all makes sense. The web page you link to is talking about preventing people from hacking your app to bypass the in-app billing.

Example: Let's suppose you've built a fun game that people can play, by installing your app on their Android phones. You use in-app billing to let people buy cool items that make the game more fun: "The Sword of Truth", or something like that. Of course, a hacker could always try to make a copy of your .apk and modify it to change your code so that they get The Sword of Truth, without having to pay you for it. You might not be very happy about that. What can you do to protect yourself against that threat?

Well, the Android security manual tells what you can do to make that kind of hacking harder and thus protect your revenue stream. The important thing to understand is: there is no strong defense. In this situation, a dedicated and motivated attacker will always win. The most you can hope for is to introduce a speedbump, to make it slightly harder for someone to hack your game. The hope is that this will be enough to reduce (but not eliminate) hacking, and thus protect your revenue stream about as well as is reasonably possible. That's what the web page you linked to is trying to help you do.

The Android web page you linked to actually explains this pretty well. You've quoted selectively from it, but if you keep reading the nearby sentences, there is a good explanation: it says "The [public] key itself is not secret information, but you do not want to make it easy for a hacker or malicious user to replace the public key with another key." It's true that they didn't explain why you might care about that; hopefully my explanation has made this clearer.

Also, at the very top, the web page says, "If practical, you should perform signature verification on a remote server and not on a device. Implementing the verification process on a server makes it difficult for attackers to break the verification process by reverse engineering your .apk file." In general, this is the only way you can reliably defend against hacks that reverse-engineer and modify your game.

For more on the general topic of preventing hackers from cheating in online games, I highly recommend the following article (it is readable, insightful, still relevant today, and just all-around fantastic):

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.