我为 Android 应用内结算的安全性付出了多少努力？
我在我的 Android 应用程序中实现了应用内计费。我几乎遵循示例（Dungeon）应用程序来使其工作。目前看来运行良好。我现在需要决定应该在安全部分投入多少精力。
我确实有一个可以用来实现 Security.java 内容的服务器。我目前也在使用标准的PurchaseDatabase 实现。
截至目前，我正在考虑使用设备特定密钥加密 .db 文件，而不要理会 Security.java。
我的想法是，我的应用程序是一个非常小众的应用程序，我预计不会有很多黑客攻击它。如果有人努力节省几美元（每件购买的商品只需 1 美元），那就这样吧。
我想我正在寻找其他人对此的看法...似乎没有 100% 安全的实现...只是使黑客攻击不值得付出努力的实现。其他人是否见过很多针对应用内购买的黑客攻击？
I implemented In app Billing in my Android application. I pretty much followed the sample (Dungeon) application to get it working. It seems to be functioning fine as of now. I now need to decide how much effort I should put into the Security portion.
I do have a server that I could use to implement the Security.java stuff. I also am currently using the standard PurchaseDatabase implementation.
As of right now I am thinking of just encrypting the .db file with a device specific key, and leaving Security.java alone.
My thinking is that my app is a pretty niche app, and I am not expecting a lot of hacking on it. If there are some people that put in the effort to save a couple bucks (each item to be purchased will only be $1), so be it.
I guess I am looking for opinions on what other people think about this...it seems there is no 100% secure implementation...just implementations that make the hacking not worth the effort. Have other people seen a lot of hacking of In App Purchases?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
你说得对：你不需要实现非常复杂的保护功能，你需要实现需要花费太多时间才能找到和删除的保护功能这是来自 Google I/O 2011 的视频，介绍了减少“水蛭”的技术： http://www.youtube.com/watch?v=TnSNCXR9fbY，我强烈推荐它。您可能想要尝试的一些技术是：
其中一些技术非常简单，另一些则需要付出不可忽视的努力。最好的建议是发挥创意，将检查隐藏在破解者意想不到的地方。
另一个重要的一点是，如果您怀疑存在盗版行为，请让您的应用程序正常降级。例如，不要抛出“无效许可证”，因为您的许可证检查需要在应用程序启动时进行网络访问；相反，在某个地方存储一个“两个月有效”的令牌并随机更新它。在随机天数（例如 30-60 天范围内的随机整数）后检查它。客户不会注意到此检查，并且很难破解，因为经过很长时间（比破解者愿意在单个应用程序上花费的时间要多得多）之后它才会变得不明显。
You got it right: you don't need to implement very complex protection features, you need to implement protection features that take too much time to be found and removed Here's a video from Google I/O 2011 about techniques to reduce "leechers": http://www.youtube.com/watch?v=TnSNCXR9fbY, I thoroughly recommend it. Some techniques you may want to try are:
Some of these techniques are very simple, other require a non negligible effort. The best recommendation is to be creative, hide checks where crackers do not expect them.
Another important point is to make your application degrade gracefully if you suspect piracy. For example, don't throw an "invalid license" because your license check needs network access on application start; instead, store somewhere a "valid for two months" token and randomly update it. Check it after a random number of days (say, a random integer in the 30-60 days range). Customers won't notice this check and it is hard to crack because it will not be apparent after a lot of time, much more time than crackers are willing to spend on a single application.