Webservice for Android Market purchases

As Google stores your purchases of Android apps, I was wondering if they are somehow offering a webservice that can be u开发者_如何学JAVAsed to check if a certain app has been purchased. To me this seems the most secure way of distinguishing free and paid users from within my app.

It would not only defeat piracy, but would also allow for managing a database of legally registered users, by a one-time check through this service.

What are your solutions to this matter?

---

Google provides a library for you. See here.

Note that this has been compromised in unprotected apps, so you should use something like ProGuard. The link above contains more information.

Finally, keep in mind that the Android Market is not the only app market for Android out there. Amazon has their own DRM.

---

At this particular moment there is one way to check.

The Android Market authenticates purchases through Google Checkout, but Google has not implemented the Checkout API to synchronize Market purchases. So calls like that check the status of an order do not work. Maybe Google doesn't want dev's to get a hold of customer emails? Either way, I do not know why it does not exist, it seems to me that if Google simply made this service available we could implement a far more superior security system that would better utilize the methods of obfuscation. As it is at the moment, a hacker can simply look for a specific class like the ILicenceService and hook it.

The only way at the current moment is to download a list of current purchases. You can do this using an authenticated http call. The drawbacks to doing this are pretty large though. First, the list it provides only extends back 31 days (so you've got to make sure you keep everything). Second, you would have to call and parse at least every ten minutes. Actually faster than that, most users want to play their games when they buy them. Third, if your service, or server goes down, that is precious information that is being requested almost instantly by your users.

I don't know how many dev's are currently utilizing this process, I considered it, but am just going to keep complaining to Google for a better method.

---

You could piggy back off of the LVL. I have just implemented a similar system.

1. Perform Check via LVL.
2. On success make a post to your own web server and store whatever details you need, i.e. DeviceID etc.

You could also perform checks to your own server even when the LVL check fails and allow things like trial periods etc.