I'm looking for a good way to store virtual goods and virtual currency balance in an Android game. Since these are "consumable" or "unmanaged" goods the balance is not backed up by Google and so there is a need for a solution that is:

  • Can't be hacked easily
  • Can easily be extended with additional goods and currencies
  • Survives application shut down and device boot
  • \$\begingroup\$ I'm don't think there is any single best way to do it. Perhaps it's just the answer already provided that's swaying my opinion, but I think the answers you'll get here won't be constructive. \$\endgroup\$ – MichaelHouse Oct 9 '12 at 20:43
  • 1
    \$\begingroup\$ I agree with @Byte56. Also I think this question is a bit too broad. \$\endgroup\$ – Pixelapp Team Oct 9 '12 at 21:57
  • \$\begingroup\$ I thought suggesting an answer to your own question is part of the practice here. Will be happy to get more options. \$\endgroup\$ – Yaniv Nizan Oct 9 '12 at 23:09
  • \$\begingroup\$ The problem is not you answering your own question. That's perfectly acceptable. The problem is the question is asking for the best method of doing something. The best method will vary depending on the person implementing it, the project they're implementing it for and the amount of time they have to implement it. There's simply no way to answer that and have an answer that's correct for everyone. \$\endgroup\$ – MichaelHouse Oct 9 '12 at 23:37
  • \$\begingroup\$ Makes sense - I edited so it will say "I'm looking for a good way" \$\endgroup\$ – Yaniv Nizan Oct 10 '12 at 10:57

Here's a slightly different take on the matter: Of the users who would bother to crack your game's data format or decompile it and change it, how many do you think are actually willing to pay for these things? In other words, if these users were to try and fail to cheat your game, do you think they would then give up and pay you money for the items?

Furthermore, are these people going to influence other users elsewhere?

If this is a game where users interact with each other (e.g. a MMO), and these paid items give users an advantage over other users, then the items, purchases, and player interactions need to be tracked on your server, so that your server can verify all interactions involving items, that the items were paid for and not yet used. The client side cannot be trusted; there's no way to definitively prevent hacking.

If this is not the case (e.g. Temple Run), why waste your effort trying to stop users who probably wouldn't pay you anyway, and who aren't affecting other paying users?

As for your other two sub-questions, just store them however you want to store your data. You already found the different ways to store data, as you posted in your answer, so read through them, figure out which ones will satisfy your requirements, and then pick whichever one you think would be best and go with it. All of them survive shutdown and reboot (thus the concept of "storage", versus just an in-memory variable), and the ability to extend them is up to you to engineer.

| improve this answer | |
  • \$\begingroup\$ Single Player games can make millions with in-app purchases (Subway surfers is one example). Unlike online games all mobile games are social by nature - the users are just interacting outside of the virtual world (aka offline). \$\endgroup\$ – Yaniv Nizan Oct 11 '12 at 7:44
  • 1
    \$\begingroup\$ I assume you mean all mobile games can come up in casual conversation. Then by that definition, everything in the entire world is social. Still, the only thing I'd worry about is if the user is able to negatively impact the experiences of other users. If the user cheats your game to get a super sword and then kills a bunch of other users, those people have been given an unfair disadvantage and will probably be upset. But if the user sets their score to 99999 and posts it on their Facebook wall for their friends to see, so what? If they hand their phone to a friend to look at, again, so what? \$\endgroup\$ – Ricket Oct 11 '12 at 14:21
  • \$\begingroup\$ I like your points. We are probably getting a bit off topic from the original question. My observation is that most players would feel rather stupid if they paid $5 in in-app purchasing only to find out that their friend cheated his way into getting the store. In addition, I would also say that most game developers (for mobile casual games) would feel a need to add a layer of protection to the game data. \$\endgroup\$ – Yaniv Nizan Oct 11 '12 at 22:51
  • \$\begingroup\$ I want to follow up with you on a few other topics if you are open to that. Can you shoot me an email to yaniv [at] soom [dot] la. \$\endgroup\$ – Yaniv Nizan Oct 11 '12 at 22:52
  • \$\begingroup\$ @YanivNizan Please host the discussion in our chat so that other users can take part too! If you want to direct something towards me, write a chat message with "@Ricket" then I'll get a notification about it. I replied to the email you sent me. If you want to add a layer of protection to the game data, then do so; it certainly can't hurt. Just don't expect anything short of a client-server solution to be bulletproof; if you encrypt it, the key is in the app. This is why e.g. DVDs are encrypted but the encryption's long been broken. \$\endgroup\$ – Ricket Oct 12 '12 at 0:01

Here is the full list recommended by Android Developer Site: http://developer.android.com/guide/topics/data/data-storage.html

  1. Shared Preferences - Store private primitive data in key-value pairs.
  2. Internal Storage - Store private data on the device memory.
  3. External Storage - Store public data on the shared external storage.
  4. SQLite Databases - Store structured data in a private database.
  5. Network Connection - Store data on the web with your own network server.

I was looking for an Internal storage so #3 and #5 are out of the question. I found that SQLite DB beats storing on a file since it can be encrypted in a much better way and it is built for the purpose of quick storage and retrieval.

| improve this answer | |
  • 1
    \$\begingroup\$ -1 I disagree, there could be better ways for different people's needs. You can't say this is the best way. This answer is highly opinionated and doesn't back up its claims with facts. \$\endgroup\$ – MichaelHouse Oct 9 '12 at 20:45
  • \$\begingroup\$ @Byte56 I have seen a lot of game developers doing that with files that weren't even encrypted so I thought it would be good to share the knowledge. Why don't you write a better answer? \$\endgroup\$ – Yaniv Nizan Oct 9 '12 at 23:08
  • 5
    \$\begingroup\$ @YanivNizan "SQLite DB beats storing on a file since it can be encrypted in a much better way" Um... wha? You can encrypt the data however you want. What does using SQLite offer? \$\endgroup\$ – Rushyo Oct 10 '12 at 12:17
  • 1
    \$\begingroup\$ @Rushyo - Yes, technically SQLite is a file but since it's abstracted as a relational database it gives two advantages: a)you can read/write single values instead of the entire file every time. b) you can encrypt single values rather than the entire file every time. This makes it a much practical storage solution. Also - some people say storing on files feels like we are in the 90's. \$\endgroup\$ – Yaniv Nizan Oct 11 '12 at 22:56
  • 4
    \$\begingroup\$ @YanivNizan But you can do those things with 'flat' files just as easily... /confused \$\endgroup\$ – Rushyo Oct 18 '12 at 11:03

How much work vs reward do you want? Even if your code is obfuscated and complex it is probably easy to hack the build to force it to think there is loads of money.

You can register all your purchases against a database controlled by you and manage it and don't allow anyone to make any purchases offline.

If you store it on the device, just store it in the internal memory and unless people have rooted phones it should be pretty secure for most cases.

The goal shouldn't be 100% security here, just good enough deterrent in order to ensure most users make purchases.

| improve this answer | |

The most security aproach is to store the players balance in a DB on a server side , and process the information about the payments in the servers side, you can use A SSL conection so your data will be safe

In terms of work , you can simply add a md5 or SHA-512 with a secret key in both sides(client and server) but they still can get your secret key and hack you

If you want to do more work, App can ask a token to the server to make the pay transaction to ensure the petition was done by the app and use it as a secret key

btw there is no safe way, there is always a black hole

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.