Protecting An App For Market

Question

I'm working on my first Android app, and am almost to the point where I can start thinking about putting it up on the market as a paid app.

In the process of researching this step, I found out that it's basically trivial to break Google's copy protection scheme. I don't know how big of a problem this really is, or if we need to look into some other form of protection.

Obviously an obfuscater like ProGuard is a good first step, but how would you go about protecting your application from being released into the wild?

Second, other than encrypting contents (which is difficult because the decryption key has to be stored in the program too) how would you prevent someone from just dumping the contents of a sqlite3 database?

Answer 1

It sounds like you have two security concerns:

1. Users copying and distributing your application without paying
2. Developers decompiling your source code and stealing it for their own applications

Concern #1: Its definitely possible for users to do this. One solution would be to give the app away for free, but disable it until they register on an independent website (where they pay). However, this kind of defeats the purpose of using the market as a convenient way to distribute your app.

Concern #2: This is a problem developing Java applications in general and isn't really specific to Android. As you stated, using an obfuscater is a good start. However, you are always going to be able to decompile Java code, and there really isn't any easy way around this that I know of.

My opinion is that piracy is very difficult to stop if the culprit has enough motivation. However, in general I don't think its a huge concern for Android developers. I know lots of people who wouldn't blink about downloading pirated movies or video games, but pay for all of their mobile applications.

Answer 2

1. Don't use sqlite. Use your own custom format. That's not unbreakable, but will definitely make it harder to extract data
2. Just don't keep your sensitive data at customer device. Keep it in Internet on your own server. And make your app just as a "thin" client to your server-side data/app.

For now 90% of devices have Internet connectivity for 90% of their running time. You should consider the importance of your data and either choose to keep it always server-side, requiring Internet connection, or keep it at client-side, making it vulnerable.

Answer 3

Everything is about to change: http://www.itproportal.com/portal/news/article/2010/7/28/google-add-licensing-service-android-apps/

Answer 4

Just today Google released details of the new licensing service which is intended to replace copy protection. See here for details: http://developer.android.com/guide/publishing/licensing.html