What are my options for implementing a virtual credit system for a Mac application?

Question

I am creating an application that I intend to distribute through the Mac App Store. I will use in-app purchases so that users can buy “credits” that they can use in the app. I will use the Apple IAP API to process transactions on the transaction side, but I am wondering what is the best way to safely store the current credit balance.

Obviously, I would like smart users not to mess with application files on disk to increase the number of credits, so at least I need to encrypt this file. But even this is not enough, because the user can simply restore from the backup to restore the credit balance.

One obvious option is to start your own web server and connect the application to it for each transaction, but that sounds cumbersome. I was looking for virtual currency services for iOS (since it is much more common in iOS applications), but most (all?) Of them have some cross-marketing angle for them, forcing me to advertise in my application, I don’t want to. I will gladly pay for a service with a simple API if it is completely transparent to my users. For instance. I do not want my users to register on any third-party website.

What are my options here? Any tips?

Answer 1

IF you really need any real security, you need to use a server.

No matter what cryptography you use on the client side, users can always reset the application status and then add a receipt for IAP, which you will then check. In short, they can always erase the phone’s memory that they consume these loans.

If what they buy is available only in the application (i.e. its simply software-unlocked functionality) and is not provided by an external server / service, then a reasonably motivated user (probably with a hacked phone) can simply configure your code to provide this functionality . Thus, in this case you cannot have real security. Your best bet is just obfuscation.