I'm looking for a good way to store virtual goods and virtual currency balance in an Android game. Since these are "consumable" or "unmanaged" goods the balance is not backed up by Google and so there is a need for a solution that is:
Here's a slightly different take on the matter: Of the users who would bother to crack your game's data format or decompile it and change it, how many do you think are actually willing to pay for these things? In other words, if these users were to try and fail to cheat your game, do you think they would then give up and pay you money for the items?
Furthermore, are these people going to influence other users elsewhere?
If this is a game where users interact with each other (e.g. a MMO), and these paid items give users an advantage over other users, then the items, purchases, and player interactions need to be tracked on your server, so that your server can verify all interactions involving items, that the items were paid for and not yet used. The client side cannot be trusted; there's no way to definitively prevent hacking.
If this is not the case (e.g. Temple Run), why waste your effort trying to stop users who probably wouldn't pay you anyway, and who aren't affecting other paying users?
As for your other two sub-questions, just store them however you want to store your data. You already found the different ways to store data, as you posted in your answer, so read through them, figure out which ones will satisfy your requirements, and then pick whichever one you think would be best and go with it. All of them survive shutdown and reboot (thus the concept of "storage", versus just an in-memory variable), and the ability to extend them is up to you to engineer.
Here is the full list recommended by Android Developer Site: http://developer.android.com/guide/topics/data/data-storage.html
I was looking for an Internal storage so #3 and #5 are out of the question. I found that SQLite DB beats storing on a file since it can be encrypted in a much better way and it is built for the purpose of quick storage and retrieval.
How much work vs reward do you want? Even if your code is obfuscated and complex it is probably easy to hack the build to force it to think there is loads of money.
You can register all your purchases against a database controlled by you and manage it and don't allow anyone to make any purchases offline.
If you store it on the device, just store it in the internal memory and unless people have rooted phones it should be pretty secure for most cases.
The goal shouldn't be 100% security here, just good enough deterrent in order to ensure most users make purchases.
The most security aproach is to store the players balance in a DB on a server side , and process the information about the payments in the servers side, you can use A SSL conection so your data will be safe
In terms of work , you can simply add a md5 or SHA-512 with a secret key in both sides(client and server) but they still can get your secret key and hack you
If you want to do more work, App can ask a token to the server to make the pay transaction to ensure the petition was done by the app and use it as a secret key
btw there is no safe way, there is always a black hole
