19

I was wondering, if I have an app that is available on the Play Store, is it "safe" to provide a direct download of the apk file to someone (either signed with the proper keys, or just debug-version)?

"safe" in the sense of does the marketplace do anything special to the apk to protect the source code, signing keys, etc.?

Reason I ask is a user of my app has said that their Marketplace/Play Store is no longer working and therefore can not upgrade the app - so asked me to email them the apk file.

The app is a free app, so on the surface I can't see any issues - though just wanted to double check.

Although this raises the question - the apks of the apps you download from the marketplace (paid and unpaid) are on your phone. Are these apks (on the phone) somehow unique to the phone/google account? Otherwise, what stops one from buying an app and passing that apk on to others?

Improve this question
6
  • Is this a development question? Development questions are off topic here sorry!
    – Liam W
    Dec 16, 2012 at 8:15
  • 5
    @LiamW It isn't. At least there's no programming involved here.
    – Irfan
    Dec 16, 2012 at 9:23
  • @Power-Inside However, it is talking about Google Play and APK's from a developer perspective.
    – Liam W
    Dec 16, 2012 at 9:37
  • Yes, I wasn't quite sure where to ask the question, here or stackoverflow. But since there was no code, and is very Android specific decided to ask here :)
    – pyko
    Dec 16, 2012 at 12:22
  • 2
    Protip Do not upload debug apks - that's a moth to a flame - people will know exactly what is going on with the source and will rip you off and pass it off as their own work. Use proguard, but since this is android enthusiasts stack exchange, head over to the sister site StackOverflow to find out! :)
    – t0mm13b
    Dec 16, 2012 at 17:53

2 Answers 2

Reset to default
15

There is nothing dangerous about it, and this is done occasionally when the store isn't accessible.

In response to your second question, apks are not unique - and can be easily transferred to another device, or the internet. This is the base of android app piracy.

When you upload the APK to Google Play, GPlay does nothing to it. It is up to the developer to obfuscate the code, to prevent decompilation.

Improve this answer
15

As Liam already pointed out, there's no danger involved for the developer. If one wants to grab the .apk for distribution, that's easily possible using apps like AppMonster, which can back up the .apk file to SD card. No extra protection from Google's side -- except users might feel more safe installing it from a "trusted source" (and they are right about that at least when it comes to unknown/new devs, as the Google Bouncer adds a protection layer against malware, see Android and Security).

In fact many developers hold their apps .apk files available on their project site for good reasons. One you already mentioned in your question: Playstore might have (temporary) problems. Moreover, not all devices are able to access the Playstore (and thus could not use your app if it would be available only there). Another good reason would be to provide "Beta versions" this way, so as a dev you can get early feedback without running the risk of negative feedback on the Playstore.

To sum up: At least for free apps, I'd even recommend to keep a direct download link to the .apk available, if possible.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .