In app-purchases, how to obsfucate PurchaseDatabase?
<p>In the in-app purchase sample:</p>

<p><a href="http://developer.android.com/guide/market/billing/index.html" rel="nofollow">http://developer.android.com/guide/market/billing/index.html</a></p>

<p>The PurchaseDatabase class has the following comment:</p>

<pre><code>/**
 * An example database that records the state of each purchase. You should use
 * an obfuscator before storing any information to persistent storage. The
 * obfuscator should use a key that is specific to the device and/or user.
 * Otherwise an attacker could copy a database full of valid purchases and
 * distribute it to others.
 */
</code></pre>

<p>Makes sense, an attacker could copy the database to another device and my app would consider all the purchase data legit.</p>

<p>So I'm not sure how they want us to obfuscate using a key that is specific to the device (I don't have any "user" data, so don't think that's really an option in my case"). I'm guessing it might go something like this:</p>

<ol>
<li>Create a unique "ID" for the installation, maybe just a timestamp I generate at installation time.</li>
<li>Store the ID in shared prefs.</li>
<li>Use the ID for encrypting all my values to the database.</li>
<li>If an attacker copies their database to another device, the other device will have a different timestamp ID it uses for encryption. Therefore when my app tries decrypting anything from the PurchaseDatabase, it should all be invalid data.</li>
</ol>

<p>Is that what they mean? It's very easy to come up with naive security measures, feeling like this is a an excellent chance to do something goofy that offers no additional protection,</p>

<p>Thanks</p>
