Mapping Google Checkout Users for Android Licensing Responses

Question

I am using Android Licensing as described here:

http://developer.android.com/guide/market/licensing/index.html

(... to make sure that my clients for my Android application really paid for the application.) My application has a server component on the Internet, and for added security I am doing a license check on this server.

Everything is working fine. Now, to my problem. As each new user associates resources on my central server, I am actually reluctant to receive insolvent users. I have seen some evidence that users continue to use the application after receiving a refund (for the usual 15-minute grace period).

To curb this behavior, it would be great if there was some way to correlate user payments on Google Checkout to actual users on my system. Is it possible?

The ResponseData that I get from the Android license server contains a field called "userId", but this does not seem to match any information in Google Checkout. (See http://www.androidadb.com/source/skylight1-read-only/GoogleLVL/src/com/android/vending/licensing/ResponseData.java.html for a ResponseData definition.)

Is it possible to determine which payment in Checkout is associated with the installation of the application?

Answer 1

As I understand it at the moment, userId gets confused even on the basis of each application, so that you can uniquely identify users in the application, but do not indicate which user it is, and not the same user bought another application.

But I'm not sure that you really need to identify these clients based on userId . If you have a server that works anyway, the best way to protect your application is to check the server for a license.

• App -> Server: give me a new nonce
• Server -> Application: here is a safe random exception
• Application -> License service: check user license with this safe random inactivity
• Licensing Service -> Application: signed license response, including nonce repetition
• App → Server: check license signature with secret key (only on the server)
• Server → Application: reject or provide an arbitrary token for access, etc.

In this case, you will not authenticate users, even if they are busy with your LVL verification code.

However, you can, of course, introduce vulnerabilities after step 6 if you are not looking at your step. However, if you are currently using standard LVL code and an App-side license with the secret key stored in your application, switching to the mechanism described above will be a big improvement (even a script to remove the standard LVL code check from applications )