Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

About a month ago I bought a game called Whale Trail during a sale on Google Play. Today, when I tried to play the game on the subway, it asked to verify the game's license, and failing to do so (since there was no internet connection on the subway), shut the game down. When I got home, I took a look at the game's permissions tab and saw this:

Market license check

Can check if you have a license for this application from Market

It seems like this is a feature built into Google Play. So my question is, how does this "license check" work? How often does apps using this "feature" phone home to verify that indeed I'm not a dirty pirate stealing these developer's apps?

share|improve this question

migrated from gaming.stackexchange.com May 2 '12 at 13:56

This question came from our site for passionate videogamers on all platforms.

2  
I'm no expert on it, so not going to answer, but information is here. The quick and dirty: Application is purchased and the .apk file is licensed to you, it goes over the network to check the license. It's possible the network wasn't available to you at that time and the developer didn't cache anything or handle that. –  Doozer Blake May 2 '12 at 12:54
    
@DoozerBlake So the answer is - "As often as the developer chooses"? I think that is acceptable as an answer –  Yi Jiang May 2 '12 at 14:10
add comment

1 Answer

up vote 16 down vote accepted

You can choose when, and how often, you want your application to check its license and you have full control over how it handles the response, verifies the signed response data, and enforces access controls.

From http://developer.android.com/guide/market/licensing/overview.html

So yes basically whenever the developer wants it to. I'd imagine the most common time to check is when the application is first opened.

Your application does not query the licensing server directly, but instead calls the Google Play client over remote IPC to initiate a license request. In the license request:

  • Your application provides: its package name, a nonce that is later used to validate any response from the server, and a callback over which the response can be returned asynchronously.

  • The Google Play client collects the necessary information about the user and the device, such as the device's primary Google account username, IMSI, and other information. It then sends the license check request to the server on behalf of your application.

  • The Google Play server evaluates the request using all available information, attempting to establish the user's identity to a sufficient level of confidence. The server then checks the user identity against purchase records for your application and returns a license response, which the Google Play client returns to your application over the IPC callback.

So:

  1. The information about the application, the device and the user goes off to Google's servers.
  2. Google then checks your name against the list of people it knows have paid for the application on Google Play. (It could also check the name of the application against a list of applications it knows that you've downloaded from Google Play)
  3. If it can see that you have downloaded (and paid for) the application from Google Play it sends back that you have a license, if not then it tells the app you don't.

Obviously this is all done online so if you're offline then it won't work. If I was writing the application I would have a counter to let the person to use it offline 3 times or so before having to go online to get the license check in order to stop the kind of thing happening to you where you can't play offline. Of course if someone digs into the file where the counter is stored they could change the value back to 3 tries every time they use it and never have to pay but that's probably beyond the technical competence of most users.

share|improve this answer
add comment

protected by Matthew Read Aug 31 '12 at 13:16

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.