0

I have read some question's answer on stackoverflow about how to prevent an app from being shared after downloading it form Google Play Store. Such as:

Adding Google Play Licensing: How to secure an Android app against sharing apps like ShareIT & more?

Adding Google Play Licensing and In-app Billing: How to prevent android app being downloaded outside google play

In some places, I have also seen Google Play Licensing can be cracked with some third party softwares or rooting the device. Such a video's link of youtube: How To Remove License Verification From All Android Apps

However, the video was uploaded three years ago, so I don't know if it will work in 2020 or there might be other new ways of doing it.

So, is it a better option to publish an app with in-app billing/purchase to avoid piracy or it also have some drawbacks?

Rawnak Yazdani
  • 1,333
  • 2
  • 12
  • 23
  • People are very reluctant to install a paid app. You will get much more installs if they can first try it for free. – from56 Nov 12 '20 at 12:31
  • @LluisFelisart It is not about the number of installations, it is about piracy. My question is about my app getting pirated. Plus, I will have a free/lite version of my paid app, so people will have the option to try the free version first. – Rawnak Yazdani Nov 12 '20 at 16:18
  • I added an answer – from56 Nov 12 '20 at 19:17

1 Answers1

1

As with any type of digital document, the safest system to verify its authenticity is to verify the signature.

The signature is a series of bytes added to the document that were generated using a private key and then can be verified using a public key.

Both licenses and google in-app purchases have a signature but few programmers verify it and instead believe that verifying the token (a unique identifier) ​​on Google's servers is enough, when it is possible for the hacker to replicate fake purchases using the same valid token (Buy it one time and use it a lot of times)

On the other hand, it is not possible to generate a valid signature without having the private key that only Google knows.

But some hacker apps like freedom alter the Android security library so it always gives the OK to any signature verification, that is why Google recommends to verify the signature on an external server, here is an example of how do it https://stackoverflow.com/a/48531877/7690376

You have to verify the signature and you have to do it on an external server, in this way it is almost impossible for your app to admit fake purchases or licenses.

from56
  • 3,976
  • 2
  • 13
  • 23