title: Why is signature verification on remote server more secure than on device?
body: <p>The <a href="http://developer.android.com/guide/market/billing/billing_overview.html#billing-security" rel="nofollow">Security Controls</a> section in the In-app Billing overview instructs to perform a "signature verification" at a remote server rather than in the app (running locally on the Android device):</p>
  
  <blockquote>
    <p>By performing signature verification you can help detect responses
    that have been tampered with or that have been spoofed. You can
    perform this signature verification step in your application; however,
    if your application connects to a secure remote server then we
    recommend that you <strong>perform the signature verification on that
    server</strong>.</p>
  </blockquote>
  
  <p>But if I perform the signature verification on the remote server, expecting only a <code>yes/no</code> or <code>true/false</code> answer, isn't this actually easier to intercept and modify by an attacker?</p>
  
  <p>And if the answer from the remote server is yet another signature, then how verifying the second signature locally on the device safer than doing so for the first (Market) signature?</p>
  
  <p>What am I missing?</p>
  
  <p><strong>Update:</strong> @alf noted correctly that if the server is also responsible for delivering purchased content and the signature verification is performed on the server, then even if the attacker compromises the app, the server will not deliver the content purchased via In-app billing. This is trivial and well understood.</p>
  
  <p>What I failed to mention originally is that I am actually referring to a scenario in which the server <strong>does not deliver any content</strong> but rather only verifies the signature, so that the app can decide whether to <strong>unlock certain features</strong>. In such case, what is the advantage of remote server signature verification over in-app one?</p>