安全性：LVL 与应用内购买
我的第一个付费 Android 应用程序在 1 天内就被无情破解，这让我意识到 LVL 安全性是多么的可悲。
我的下一个应用程序将通过托管应用程序内购买内容来获利，这似乎比 LVL 更安全，因为应用程序内购买是使用可以由我的内容服务器验证的私钥签名的。我的应用程序可以轻松破解和重新分发，但我的内容服务器却不能。 （我知道没有什么是绝对安全的，但这种方法看起来比 LVL 更好）。
在我看来，破解应用内购买的唯一方法是：
- 破解我的内容服务器
- 破解我的私钥
应用内购买比 LVL 更安全还是我太天真了？ 私钥容易被破解吗？
提前致谢...
My first paid Android app was mercilessly cracked within 1 day, which made me realize how pathetic LVL security is.
My next app will monetize with managed in-app purchases of content, which seems more secure than LVL because in-app purchases are signed with a private key that can be verified by my content server. My app can be cracked and redistributed easily but my content server cannot. (I know nothing is absolutely secure but this approach looks better than LVL).
It seems to me the only way to crack in-app purchases is to:
- Hack my content server
- Crack my private key
Are in-app purchases more secure than LVL or am I being naive?
Is the private key easy to crack?
Thanks in advance...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
它确实更难破解，因为 LVL 已经众所周知，并且破解它的方法（甚至是自动化的）已经很普遍。然而，从技术上讲，应用内购买并不更安全，除非实际从您的服务器下载了操作被阻止功能所必需的内容（例如代码）。原因是，您的应用程序可以执行的任何操作，人们都可以检查，并且人们可以做本身，即使是在代码的修改版本中。例如，您可以通过 SSL 向服务器验证所有者是否已进行购买，但恶意攻击者始终可以删除该代码，并使应用程序表现得就像服务器已批准它一样。如果您的应用程序下载了私钥，恶意用户可能会找到一种方法来冒充您的应用程序并下载它，等等。
确实没有“无法破解”的软件。只有服务才能相对安全，免受盗版侵害。因此，如果你想避免盗版，你应该编写产品即服务的软件。
It is indeed harder to crack because LVL is already known and methodology of how to crack it (even automated) is already widespread. However, in-app purchases are technically not more secure unless stuff is actually downloaded from your server that is necessary to operate the blocked features (e.g. code.) The reason is, anything your app can do, people can examine, and people can do themselves, even in modified versions of your code. For example, you may verify with the server over SSL that the owner has made a purchase, but a malicious attacker could always remove that code and just make the application act as if the server OK'd it. If a private key is downloaded by your application, a malicious user could find a way to impersonate your application and download it, etc.
There is really no 'uncrackable' software. Only services can be relatively safe from piracy. Therefore, if you want to avoid piracy, you should write software where the product is the service instead.