Android - store whether a user account is pro in a secure way
<p>I am developing an Android frontend to a web application using its API.</p>

<p>This Android application will expose some extra features if the user is a 'pro'.</p>

<p>Therefore I need the Android app to acquire the information whether an account is pro. That is done while getting the token. In other words, when the Android application requests a token to the web application via the API, the web application provides also a flag representing whether the user is a pro.</p>

<p>When the Android app gets that piece of information, it stores it in the SharedPreferences, like this:</p>

<pre><code>this.sharedPreferencesEditor.putBoolean(Account.PRO_ACCOUNT, isPro).commit();
</code></pre>

<p>Then the Android app reads that value to decide whether a certain feature is available to that user.</p>

<p>Now, my question is: is that approach easily hackable? I mean, can some clever user work-around this system and get pro-features even if they are not pro-users? How could do that?</p>

<p>Can you suggest a better system to accomplish that?</p>

<p>Thanks,<br>
Dan</p>
