When selling online content, it's
important to deliver the correct content to the right user
and to help you do this, Google has
designed its best process and guidelines
for secure transactions.
Hi, I'm Neto Marin, and I'm going to show you some tips
and best practice to make our transactions safer.
If you're looking for an introduction to in-app billing
or how to use in-app billing API in your app,
don't miss our two previous episodes.
Some attackers or pirates can try to hack the user's device
or pretend to be a trusted source
and then provide wrong responses to requests
and get your content and items but there are three best
practices you can follow to keep attackers
from stealing your content and other users' items.
First, use the developer payload, two,
signature verification, and three,
server-side verification.
Let's take a closer look at each.
The developer payload is an arbitrary string
you can set to handle making the purchase request call
and when the purchase is completed,
or whenever you make a call to get users purchase,
Google Play will return the data of the same string.
So you should use some strings to identify users' ownership
like Google Play ID or email.
Secondly, when you are using the in-app billing API,
all responses from Google Play are signed.
Remember, you can find your public key in the developer
console and you should check every request
to make sure they get purchases and subscriptions
against that key.
With a few lines of code, you can
check if the response was signed using your verification
private key that only Google has.
You can find a complete on how to do this in the CQ Java
class of the Trivial Drive simple app.
Another precaution you can take if difficult attackers should
break the verification process in the phone
is do the signature verification on the server-side.
To do this, after getting the response from Google Play,
you can send it to be verified on the server-side.
These three best practices will make your app safer
and avoid the major kinds of attacks your app could suffer.
If you use at least a client-side signature
verification, it's enough to avoid the man-in-the-middle
attack but if you add the unique developer payload [INAUDIBLE],
you can also be sure about item ownership.
And if you also implement the server-side verification,
your app will be safer even if the framework is compromised.
In addition to these security best practices,
you can take some actions with your code
and content to increase even more
of this security in your app.
For example, build the system to distribute the content offered
by your app instead of packing everything into your APK.
This protects against people that try to open your APK
and steal resources and content.
The most basic precaution you should take with your code
is obfuscate your in-app billing implementation
so that it's difficult for attackers
to reverse engineer your security protocols
and modifications components.
In addition to running an obfuscation program,
we recommend that you use the following techniques
to obfuscate your in-app billing code.
Inline methods into other methods,
construct strings on the fly instead of defining them
as constants, and use Java reflection to call methods.
The in-app building sample application
is publicly distributed and can be downloaded by anyone,
so it's quite easy for an attacker
to reverse engineer your application
if you're using the sample code exactly
as it is published so don't do it.
If you use any part of the simple application,
you must modify it before you publish
or at least as part of a [INAUDIBLE] application.
And you must protect your Google Play public key.
To keep your public key safe from malicious users
and hackers, do not embed it any code as a literal string.
Instead, construct the string at runtime from pieces
or use a bit of manipulation.
For example, XOR with another string to hide the actual key
or download it from your backhand.
In this case, make sure to have a secure connection
and cryptographic before storing in a Drive device.
For more tips about security on Android in-app billing,
check the Security and Design guidelines
on developer.android.com and if you have any questions,
check our documentation and training guides
anytime you need and in our sample,
you can find the convenience class to help
you validate signature to make your app safer.
And don't forget-- security is very important.
Thanks for watching.
Bye-bye.
[MUSIC PLAYING]