- Obfuscation with ProGuard
- Using the License Verification Library
- Using SSL for Network Communication
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Using the License Verification Library
You've spent lots of time creating a great application. You published it a month ago and are thrilled that it's sold 1,000 copies on the Android Market—after all, you created the app during your lunch breaks. You can't retire, but you might consider quitting your day job if you can increase sales. Then you peruse your server logs. Wait! What's going on? There are 10,000 unique users? That's impossible! You've only had 1,000 sales and not enough returned applications to account for this massive difference in stats. Welcome to the world of software piracy. (Note: This is completely made up and not meant to be representative of anything, but it’s a common enough story in the Android world.)
What can you do? One solution is to live with it and be happy that your application is good enough that people took the time to steal it. Another solution is to fight back; you can start by using the Android Market Licensing to further protect your application from piracy.
The primary means to use Android Market Licensing is by integrating with the License Verification Library (LVL) directly into your application. This library is available for download through the Android SDK and AVD Manager. The LVL only works with the Android Market and is meant for paid applications. If you distribute your application through other means, you'll need to use a separate licensing scheme and may need to provide separate binaries to support these differing means.
Unlike ProGuard, the LVL is not a turn-key solution to your problems; it takes time and effort to get it set up, integrated with your application and working properly. You'll have to manage keys, policies, and testing. In addition, even the LVL is prone to exploitation. As a public shared library, the LVL code compiles the same way against in all applications. While obfuscation through ProGuard does help, even that leaves similar patterns for pirates to look for and take advantage of. The consensus is that modifying the LVL codebase to make it different from all other implementations used by other parties, while keeping the functionality, is your best defense.
It's up to you to decide if it's worth the effort using LVL. Other options include switching your application revenue model to use in-application billing mechanisms or advertising methods to make money regardless of how your users acquire your application.
For more information on Android Market Licensing, refer to this Android Guide.
For more information on protecting your applications that use licensing, see this blog post by the Android team and this Google IO video.