6 ms·
Apple has a way of validating receipts for in app purchases, see: http://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/StoreKitGu
by carson 14y ago
Apple has a way of validating receipts for in app purchases, see: http://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/StoreKitGuide/VerifyingStoreReceipts/VerifyingStoreReceipts.html http://developer.apple.com/library/ios/#documentation/Networ...
If you are using IAP in your app and want to keep this hack from working you should be validating receipts. It isn't hard to do, check out https://github.com/carsonmcdonald/iap-validator https://github.com/carsonmcdonald/iap-validator for an example.
- adjwilli 14y agoI totally agree, the best practice is to validate transactions before delivering content. It wasn't clear from the article if the method could bypass that. It would have to provide valid transaction ids to the app developer's server. That seems a little too sophisticated or impossible, so you're probably right. I guess we should really just be surprised this wasn't done sooner.
- thoughtsimple 14y ago>It wasn't clear from the article if the method could bypass that. It would have to provide valid transaction ids to the app developer's server. Even if this method does manage to bypass Apple's validation, then it is Apple's problem and they will fix it quickly. But it is much more likely that developers just haven't bothered to validate receipts.
- conradev 14y agoThis has already been done in the form of a tweak for jailbroken devices. This only brings it to unjailbroken devices.
- thoughtsimple 14y agoI wonder what popular iOS Frameworks don't validate in app purchase receipts :)
- adjwilli 14y agoYou have to do it on the server. And it's a pain to implement correctly, full of cryptic error codes. I imagine many developers skip it since it's not required by Apple.
- jen_h 14y agoThe other thing is that you're dependent on the validation server's availability to check the receipts. Apple's got great uptime in this respect (and others), but there have been outages (a big one last September: http://www.ilounge.com/index.php/news/comments/app-store-suffers-in-app-purchase-outage/ http://www.ilounge.com/index.php/news/comments/app-store-suf...). It's a tradeoff, really, that most IAP implementors consider: Cost of support and loss of goodwill when legitimate customers run into issues vs. loss of revenue from pirates (heretofore only jailbroken phone users) who likely wouldn't have purchased anyway. It makes fiscal sense for big players with big IAP scale like Zynga to strictly validate. Little players may find it is less critical to the bottom line to be strict about it.
- flatline3 14y agoYou're also dependent on Apple's purchasing servers to buy the content to begin with, so I'm not sure I see the point.
- stock_toaster 14y agoI wonder if Apple will start using certificate pinning[1] (like chrome does for google certs). [1]: http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html
- flatline3 14y agoWhy do you say it's a pain to implement? It's an HTTP+JSON API, and there's only one error code you have to care about: If the value of the status key is 0, this is a valid receipt. If the value is anything other than 0, this receipt is invalid. http://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/StoreKitGuide/VerifyingStoreReceipts/VerifyingStoreReceipts.html http://developer.apple.com/library/ios/#documentation/Networ...
- gcb 14y agoHow this affect things like buying offline maps for gps? Also that page has an invalid ssl cert :)