3
\$\begingroup\$

I want to develop a Android game using LibGDX. Let's take a classic example ; some player can battle another one in turn based matches. The outcome of match defines the reward in some ingame currency. There will be premium currency with in-app purchases, and both can be used to purchase some upgrades.

I am discovering both Android and GPG at this point. GPG allows some P2P turn battles, matchmaking and cloud saves, making it looks like quite the thing I need.

However, I have concerns regarding its security. The currencies needs, for obvious reasons here, to be fully secure, non corruptable by altering saves on the device. In the same way, it is my understanding that the turn based (and real time) matches are P2P, between devices.

My question is, what GPGS does to enforce security on both (cloud) saves and P2P matches ? Will I need to use some backend server for this case ? And if yes, how can I authenticate a player logged in GPG on this backend server ?

Thanks for any clues about that.

\$\endgroup\$
1
\$\begingroup\$

According to this Google Saved Games documentation :

Read/Write isolation

All Saved Games are stored in your players' Google Drive Application Data Folder. This folder can only be read and written by your game - it cannot be viewed or modified by other developers’ games, so there is additional protection against data corruption. In addition, Saved Games are insulated from direct tampering by players so they cannot modify individual Saved Games.

It then looks like the saves data are protected.

\$\endgroup\$
  • 2
    \$\begingroup\$ The games are only protected in a blanket sense. A determined user can still hack it. The only way to prevent this (to date) is an authoritative game server. \$\endgroup\$ – Vaughan Hilts Aug 6 '14 at 17:03
  • \$\begingroup\$ Do you have an example to how to login to a game server using Play Games (with that nice login dialog and such) on the device ? The Play Games docs, based on BaseGameActivity or even GoogleApiClient, don't offer such examples for Android. \$\endgroup\$ – Kamalen Aug 6 '14 at 17:34
  • \$\begingroup\$ I don't have any off hand, sorry. Is your data really that important? If it is, you should be rolling a custom server anyway. \$\endgroup\$ – Vaughan Hilts Aug 6 '14 at 18:02
  • \$\begingroup\$ Well it's for saving premium purchasable currency. I will further search this point and if it is hard enough to alter data, will leave this as-is. \$\endgroup\$ – Kamalen Aug 8 '14 at 13:54
  • \$\begingroup\$ Another important point to consider is that a user can DELETE their Google Saved Game profile, which kind of makes using it for currency pointless. A user could buy 100 coins, then delete their profile, and lose their coins without ever using them. This would lead to complaints/refunds/nightmare. \$\endgroup\$ – Pixel Oct 3 '16 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.