3
\$\begingroup\$

I want to develop a Android game using LibGDX. Let's take a classic example ; some player can battle another one in turn based matches. The outcome of match defines the reward in some ingame currency. There will be premium currency with in-app purchases, and both can be used to purchase some upgrades.

I am discovering both Android and GPG at this point. GPG allows some P2P turn battles, matchmaking and cloud saves, making it looks like quite the thing I need.

However, I have concerns regarding its security. The currencies needs, for obvious reasons here, to be fully secure, non corruptable by altering saves on the device. In the same way, it is my understanding that the turn based (and real time) matches are P2P, between devices.

My question is, what GPGS does to enforce security on both (cloud) saves and P2P matches ? Will I need to use some backend server for this case ? And if yes, how can I authenticate a player logged in GPG on this backend server ?

Thanks for any clues about that.

\$\endgroup\$

1 Answer 1

1
\$\begingroup\$

According to this Google Saved Games documentation :

Read/Write isolation

All Saved Games are stored in your players' Google Drive Application Data Folder. This folder can only be read and written by your game - it cannot be viewed or modified by other developers’ games, so there is additional protection against data corruption. In addition, Saved Games are insulated from direct tampering by players so they cannot modify individual Saved Games.

It then looks like the saves data are protected.

\$\endgroup\$
5
  • 2
    \$\begingroup\$ The games are only protected in a blanket sense. A determined user can still hack it. The only way to prevent this (to date) is an authoritative game server. \$\endgroup\$ Aug 6, 2014 at 17:03
  • \$\begingroup\$ Do you have an example to how to login to a game server using Play Games (with that nice login dialog and such) on the device ? The Play Games docs, based on BaseGameActivity or even GoogleApiClient, don't offer such examples for Android. \$\endgroup\$
    – Kamalen
    Aug 6, 2014 at 17:34
  • \$\begingroup\$ I don't have any off hand, sorry. Is your data really that important? If it is, you should be rolling a custom server anyway. \$\endgroup\$ Aug 6, 2014 at 18:02
  • \$\begingroup\$ Well it's for saving premium purchasable currency. I will further search this point and if it is hard enough to alter data, will leave this as-is. \$\endgroup\$
    – Kamalen
    Aug 8, 2014 at 13:54
  • \$\begingroup\$ Another important point to consider is that a user can DELETE their Google Saved Game profile, which kind of makes using it for currency pointless. A user could buy 100 coins, then delete their profile, and lose their coins without ever using them. This would lead to complaints/refunds/nightmare. \$\endgroup\$
    – user24493
    Oct 3, 2016 at 8:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .