Tell me more ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.
up vote 6 down vote favorite

As title. Of course using Android market and the Google Checkout payment. By the way, how about other market-like apps?

share|improve this question

1 Answer

up vote 8 down vote accepted

First be aware that you're transferring data over a wide area wireless device (the range of 3G is much wider than Wifi), therefore it is easier for an attacker to snoop on whatever your device is transmitting on 3G than on Wifi. The 3G/GPRS only has a lightweight encryption (to limit unnecessary use of CPU power and battery, which is already scarce in mobile devices), this encryption should never be relied upon.

However, applications can use its own encryption. I have not checked into it specifically, but I would presume that Google Checkout on Android does use SSL encryption; which is widely accepted to be strong enough for doing online purchases.

In short, you should not need to worry about doing online purchases using Android Market. If you're doing purchases on other apps, you should check whether they're using SSL or other strong encryption. Be aware that your banking details are being transmitted wirelessly, it is trivial for anyone to record data that are transmitted using radio waves; your only line of defense is SSL encryption, which should hold attackers at bay long enough until your credit card expires.

share|improve this answer
Thanks dude, that's a very clear answer. Is it possible to check that Checkout uses SSL? In computer browser there is that secure symbol, but since Checkout is an app, there is no such thing (the same for other market-like apps) – Fitri Aug 7 '11 at 15:19
2  
Keep in mind that there a lot of other things that can go wrong -- a man in the middle attack could still work if the certificate chain is not validated, etc. etc. Normally you can rely on these mechanisms, but all it takes is an incompetent CA -- of which there are many -- or a tiny flaw or exception in security software to make the whole thing fall apart. – Matthew Read♦ Aug 7 '11 at 17:01
1  
Its worth pointing out that 3G/GPRS only "feels" like it is more risky. You should consider that if someone wants to intercept a significant amount of internet traffic they will find a way. Keep your sensitive data protected regardless of how you access the 'net. – Greg Aug 8 '11 at 2:05
@greg: due to the wider range, 3G is much more risky if you're transmitting unencrypted data or weakly encrypted data such as the one used in 3G (the default encryption 3G is optimized for battery and cpu consumption, not security). Adding encryption such as SSL is necessary for any wireless communication to ensure man in middle won't be able to obtain your banking data. – Lie Ryan Aug 8 '11 at 12:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.