For developing an android app that lets people sign in with their google account, we have to submit app package name and developer signature to google. Every time that someone tries to log in to my app using his google account, google uses these information (package name and app signature) to verification that a genuine app is making the request. How does google verify it? How is the signature extracted sent to google securely?

  • Conversely what prevents an attacker from extracting the signature and using it in their own application? – Johan Oct 10 '16 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.