Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

I'm looking for a good way to store virtual goods and virtual currency balance in an Android game. Since these are "consumable" or "unmanaged" goods the balance is not backed up by Google and so there is a need for a solution that is:

  • Can't be hacked easily
  • Can easily be extended with additional goods and currencies
  • Survives application shut down and device boot
share|improve this question
    
I'm don't think there is any single best way to do it. Perhaps it's just the answer already provided that's swaying my opinion, but I think the answers you'll get here won't be constructive. –  Byte56 Oct 9 '12 at 20:43
1  
I agree with @Byte56. Also I think this question is a bit too broad. –  Pixelapp Team Oct 9 '12 at 21:57
    
I thought suggesting an answer to your own question is part of the practice here. Will be happy to get more options. –  Yaniv Nizan Oct 9 '12 at 23:09
    
The problem is not you answering your own question. That's perfectly acceptable. The problem is the question is asking for the best method of doing something. The best method will vary depending on the person implementing it, the project they're implementing it for and the amount of time they have to implement it. There's simply no way to answer that and have an answer that's correct for everyone. –  Byte56 Oct 9 '12 at 23:37
    
Makes sense - I edited so it will say "I'm looking for a good way" –  Yaniv Nizan Oct 10 '12 at 10:57

3 Answers 3

Here is the full list recommended by Android Developer Site: http://developer.android.com/guide/topics/data/data-storage.html

  1. Shared Preferences - Store private primitive data in key-value pairs.
  2. Internal Storage - Store private data on the device memory.
  3. External Storage - Store public data on the shared external storage.
  4. SQLite Databases - Store structured data in a private database.
  5. Network Connection - Store data on the web with your own network server.

I was looking for an Internal storage so #3 and #5 are out of the question. I found that SQLite DB beats storing on a file since it can be encrypted in a much better way and it is built for the purpose of quick storage and retrieval.

share|improve this answer
    
-1 I disagree, there could be better ways for different people's needs. You can't say this is the best way. This answer is highly opinionated and doesn't back up its claims with facts. –  Byte56 Oct 9 '12 at 20:45
    
@Byte56 I have seen a lot of game developers doing that with files that weren't even encrypted so I thought it would be good to share the knowledge. Why don't you write a better answer? –  Yaniv Nizan Oct 9 '12 at 23:08
2  
@YanivNizan "SQLite DB beats storing on a file since it can be encrypted in a much better way" Um... wha? You can encrypt the data however you want. What does using SQLite offer? –  Rushyo Oct 10 '12 at 12:17
1  
@Rushyo - Yes, technically SQLite is a file but since it's abstracted as a relational database it gives two advantages: a)you can read/write single values instead of the entire file every time. b) you can encrypt single values rather than the entire file every time. This makes it a much practical storage solution. Also - some people say storing on files feels like we are in the 90's. –  Yaniv Nizan Oct 11 '12 at 22:56
1  
@YanivNizan But you can do those things with 'flat' files just as easily... /confused –  Rushyo Oct 18 '12 at 11:03

How much work vs reward do you want? Even if your code is obfuscated and complex it is probably easy to hack the build to force it to think there is loads of money.

You can register all your purchases against a database controlled by you and manage it and don't allow anyone to make any purchases offline.

If you store it on the device, just store it in the internal memory and unless people have rooted phones it should be pretty secure for most cases.

The goal shouldn't be 100% security here, just good enough deterrent in order to ensure most users make purchases.

share|improve this answer

Here's a slightly different take on the matter: Of the users who would bother to crack your game's data format or decompile it and change it, how many do you think are actually willing to pay for these things? In other words, if these users were to try and fail to cheat your game, do you think they would then give up and pay you money for the items?

Furthermore, are these people going to influence other users elsewhere?

If this is a game where users interact with each other (e.g. a MMO), and these paid items give users an advantage over other users, then the items, purchases, and player interactions need to be tracked on your server, so that your server can verify all interactions involving items, that the items were paid for and not yet used. The client side cannot be trusted; there's no way to definitively prevent hacking.

If this is not the case (e.g. Temple Run), why waste your effort trying to stop users who probably wouldn't pay you anyway, and who aren't affecting other paying users?


As for your other two sub-questions, just store them however you want to store your data. You already found the different ways to store data, as you posted in your answer, so read through them, figure out which ones will satisfy your requirements, and then pick whichever one you think would be best and go with it. All of them survive shutdown and reboot (thus the concept of "storage", versus just an in-memory variable), and the ability to extend them is up to you to engineer.

share|improve this answer
    
Single Player games can make millions with in-app purchases (Subway surfers is one example). Unlike online games all mobile games are social by nature - the users are just interacting outside of the virtual world (aka offline). –  Yaniv Nizan Oct 11 '12 at 7:44
    
I assume you mean all mobile games can come up in casual conversation. Then by that definition, everything in the entire world is social. Still, the only thing I'd worry about is if the user is able to negatively impact the experiences of other users. If the user cheats your game to get a super sword and then kills a bunch of other users, those people have been given an unfair disadvantage and will probably be upset. But if the user sets their score to 99999 and posts it on their Facebook wall for their friends to see, so what? If they hand their phone to a friend to look at, again, so what? –  Ricket Oct 11 '12 at 14:21
    
I like your points. We are probably getting a bit off topic from the original question. My observation is that most players would feel rather stupid if they paid $5 in in-app purchasing only to find out that their friend cheated his way into getting the store. In addition, I would also say that most game developers (for mobile casual games) would feel a need to add a layer of protection to the game data. –  Yaniv Nizan Oct 11 '12 at 22:51
    
I want to follow up with you on a few other topics if you are open to that. Can you shoot me an email to yaniv [at] soom [dot] la. –  Yaniv Nizan Oct 11 '12 at 22:52
    
@YanivNizan Please host the discussion in our chat so that other users can take part too! If you want to direct something towards me, write a chat message with "@Ricket" then I'll get a notification about it. I replied to the email you sent me. If you want to add a layer of protection to the game data, then do so; it certainly can't hurt. Just don't expect anything short of a client-server solution to be bulletproof; if you encrypt it, the key is in the app. This is why e.g. DVDs are encrypted but the encryption's long been broken. –  Ricket Oct 12 '12 at 0:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.