Re:Google refunded $200 because I missed 5 lines of Code
by mrb on Saturday June 15, 2019 @01:10AM
(#20188481)
Wait a minute. 5 lines of code were missing in the app, causing users to be refunded. So does this mean a malicious user could decompile the app, remove this code, recompile, and get these auto refunds? This seems a way easier mechanism to get free in-app purchases rather than reverse-engineering the rest of the code.
[ Parent
| on HN ]
Re:Google refunded $200 because I missed 5 lines of Code
by abedja on Saturday June 15, 2019 @01:52AM
(#20188577)
Your recompiled version would not have the proper cryptographic signature as you don't have the keystore used by the dev on your pc
Re:Google refunded $200 because I missed 5 lines of Code
by numerlo on Saturday June 15, 2019 @04:11AM
(#20188914)
The version without those 5 lines will now be forever out there though. Malicious peers can download the apk and get the premium version for free. This feels like a poorly thought out design on Google's part.
Re:Google refunded $200 because I missed 5 lines of Code
by kabwj on Saturday June 15, 2019 @05:36AM
(#20189143)
Obviously if you decompile the application and modify it you can get the premium features for free. What’s your point?
Re:Google refunded $200 because I missed 5 lines of Code
by beering on Saturday June 15, 2019 @12:16PM
(#20190640)
numerlo is saying that users don't even need to decompile the app - they can continue sharing the buggy APK with each other to get free stuff.
Re:Google refunded $200 because I missed 5 lines of Code
by kevincox on Saturday June 15, 2019 @07:30AM
(#20189494)
You could also just modify the app to skip the "is premium" check to get all the premium features.
I would hope that there is something more robust for server-handled purchased though.