3

So I have a problem, we want to be able to sell our Android application on our site AND on the Android market. If we just stick the .apk file on our site and let people download it after they have paid for it, how do we prevent them from just giving htat .apk file to a friend? I have been searching goolge all morning for a solution. I just want someway to be able to protect our application from being installed on more then one device.

So if you get it, install it on your phone, then give it to a friend friend, it would stop him/her and display some error.

aLL
  • 1,596
  • 3
  • 17
  • 30
Josh
  • 819
  • 1
  • 14
  • 30

3 Answers3

3

First idea: provide an unlock code based on IMEI encryption on your website. When people buy the app on your website, they will have to enter a code at the app launch. The app will compare the uncrypted number to the phone IMEI.

So if people A with IMEI B share the app to people with IMEI C, the app won't work.

EDIT: read this great post to get a unique number for an Android device: Is there a unique Android device ID?

You can also try

Settings.Secure#ANDROID_ID returns the Android ID as an unique 64-bit hex string.

import android.provider.Settings.Secure;

private String android_id = Secure.getString(getContext().getContentResolver(),
                                                        Secure.ANDROID_ID);

but It's known to be null sometimes, it's documented as "can change upon factory reset". Use at your own risk, and it can be easily changed on a rooted phone.

The weakest part will now be the Market, that's really easy to share and copy it.

Community
  • 1
  • 1
Waza_Be
  • 39,407
  • 49
  • 186
  • 260
  • JFYI: Google recently launched new protection scheme which seems to bind the application to the device and also check validity from time to time online. This requires that the device goes online at least once a week, though. – Eugene Mayevski 'Callback Oct 11 '11 at 04:49
  • Some folk may question why an app needs to read phone identity. Especially if the permissions for reading state and identity are ever separated – gbn Oct 12 '11 at 02:21
  • Could you explain "IMEI" method a little more? or a link to somewhere that does? – Josh Oct 12 '11 at 14:44
  • IMEI is a unique number for all phones: http://android-coding.blogspot.com/2011/06/get-unique-device-id-imei-meid-or-esn.html There is also a great answer here to get a unique ID for a device: http://stackoverflow.com/questions/2785485/is-there-a-unique-android-device-id/2853253#2853253 – Waza_Be Oct 13 '11 at 08:03
1

You cannot stop your apk from being shared. However there is a google licensing service that you can look into. This service basically queries the google play store and finds out if the user actually bought the app . This is designed for mainly for the paid apps but you could use this in free apps too.

Tapan Thaker
  • 362
  • 5
  • 13
1

This is a problem for all kinds of software, not just .apk files.

There is no ultimate solution to this issue, there are only hacks and workarounds to make it difficult to use the software on different devices.

You have no internal concept of 'who bought the software' if you're just putting a .apk file on the web. The only way to make the application only work on certain phones is to bundle the list of authorized phones into the application.

If you do not do that, then you may, for example, require the application to talk to a centralized web-service that vets the phone ID against a list of authorized devices, allowing the application to run in this case (this is the FlexLM model).

There is a pile of documentation on the web about how to protect your application, there is probably 10x that amount of information on how to make the protection go away.

If your unit sales are low, then the inventory of authorized devices is a reasonable approach, but if you sell more than a handful of copies of the application, then the web-service approach makes more sense.

Anya Shenanigans
  • 91,618
  • 3
  • 107
  • 122