应用内计费安全和设计问题
我有几个与 Android 应用内结算相关的问题：
是否可以从非电子市场应用进行购买？我知道这将是一个漏洞，但我没有机会知道它是否可能。
如何获取特定产品的购买状态？据我了解，可以使用 RESTORE_TRANSACTIONS 请求来完成，但不建议经常使用。这不是一个理论上的问题。我的应用程序允许用户使用应用内计费购买内容。内容可以从服务器下载，并且服务器必须仅在购买内容时才允许下载内容。但如果不使用 Android Market 的签名响应，它就无法检查内容是否已购买。
如何从 Android Market 获取商品的价格和描述？似乎我知道答案，而且是“没有办法做到”，但也许我错了。如果能够检索商品的价格，将会非常有用。
我对你如何解决/将要在你的应用程序中解决这些问题非常感兴趣。对任何这些问题的回答将不胜感激。
I have a few questions connected to Android In-App Billing:
Is it possible to make a purchase from non-Market app? I understand that it would be a vulnerability, but I have no opportunity to find out if it's possible or not.
How can I get purchase state for a particular product? As far as I understand it can be done using
RESTORE_TRANSACTIONSrequest, but it's not recommended to use very often. That's not a theoretical problem. My application allows users to buy content using in-app billing. Content can be downloaded from a server, and server must allow content downloading only if it was purchased. But it can't check if content was purchased or not without using signed response from Android Market.How can I get price and description of an item from Android Market? Seems that I know the answer and it's "there's no way it can be done", but maybe I'm wrong. It would be very useful to have a possibility of retrieving item's price.
It's very interesting to me how you solved/are going to solve these problems in your apps. Answer to any of these questions will be appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
按顺序：
1-不。应用内结算流程是市场的一部分。如果应用程序来自其他地方，市场就无法验证应用程序的来源/真实性。
2- 您有责任存储特定产品的购买状态。来自文档：
RESTORE_TRANSACTIONS 应保留用于在设备上重新安装或首次安装。
3-不幸的是，此时你是对的。提交功能请求！
与此同时，一种选择是使用应用程序引擎建立一个网站，列出所有内容和内容。定价，然后手动将 appengine 服务器上列出的价格与市场中的更新价格同步。然后让您的 Android 应用程序从 AppEngine 服务器提取数据。这比将价格值硬编码到应用程序本身要好得多，因为每当您更改某些内容时，您不需要让每个人立即更新应用程序以查看准确的定价。此方法的唯一警告是，如果用户位于不同的国家/地区，应用内结算将以本国货币显示近似价格，并且您无法准确确定将向他们显示的价格。
相关的是，一位 Android 开发者倡导者正在 IO 上发表有关 LVL/IAP 的演讲，名为“使用许可证验证库、应用内计费和 App Engine 来逃避盗版并阻止吸血鬼”。 - 当他们在网站上发布会议视频时，绝对值得您花时间观看。
In order:
1- Nope. The in-app billing process is part of Market. If the app comes from elsewhere, there's no way for Market to verify the origin/authenticity of the application.
2- It's your responsibility to store the purchase state for a particular product. From the doc:
RESTORE_TRANSACTIONS should be reserved for reinstalls or first-time installs on a device.
3- Unfortunately, at this time you're right. File a feature request!
In the meantime, one option is to set up a website with appengine, store listings of all your content & pricing there, and then manually sync prices listed on your appengine server with the updated prices in Market. Then have your Android app pull the data from the AppEngine server. This is much better than hardcoding price values into the app itself, since you don't need to have everyone update the app immediately to see accurate pricing whenever you change something. The only caveat of this method is that if the user is in a different country, in-app billing will display an approximated price in their native currency, and there's no way for you to determine exactly what price will be displayed to them.
Related, One of the Android Developer Advocates is giving a talk on LVL/IAP at IO, called "Evading Pirates and Stopping Vampires using License Verification Library, In-App Billing, and App Engine." - It would definitely be worth your while to watch when they release the session videos on the website.