The requirements for a system like itunes store or google play are as follows;

  • identify and authenticate the user
  • determine if the user has paid for a given app
  • if s/he has, securely transmit the app and install it on the device

What is the strategy used in this situation? In particular, is the app transmitted in an encrypted format or in plaintext?


I'm more familiar with iOS, so I'll focus on that.

All iOS apps are signed.

When connecting to the App Store, the iPhone uses the Secure Transport API, which means you're using TLS.

I'm not quite sure what you mean by strategy, but yes the apps are transmitted securely, and are signed by Apple.

  • Thank you for the info. Now, why do the apps need to implement security, rather than the installer?
    – jamesson
    Jul 18 '14 at 20:56
  • They don't (really). The OS validates the apps certs/App Store TLS connection Jul 18 '14 at 21:14
  • sorry, what is tls please? Also, what is in the certificate? A unique user hash and/or a unique device hash and/or a unique program hash? How is the user kept from copying or modifying the certificate?
    – jamesson
    Jul 19 '14 at 2:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.