October 23rd, 2009 by Arjan Olsder Posted in Platforms: iOS | No Comments »
With the release of in-game billing for mobile games and applications on Apple’s App Store, many applauded this new way of generating revenues and fighting piracy. Yet, a few sources have started to discuss the real value of this proposition.
The first issue we see with free-but-still-paid games is that the free offering on the App Store will get overcrowded and consumers get confused about the quality of what they will be downloading. Most consumers now know that LITE and FREE games are probably limited in their functionality in the same way they know Shareware and Demo titles from their PC’s. So how will we communicate this to avoid consumers being disappointed in the free download and so, your studio? Bolt Creative has solved this pretty well by offering non-standard virtual items in their Pocket God app.
Another issue is the lack of connectivity for iPod Touch owners. A lot of these consumers may not have Wi-Fi at home. This means they can only complete their purchases via iTunes. In-game billing will simply not work for them.
And then, there is security. According to ngmoco, 90% of the sessions played in a game can originate from pirated handsets. Imagine paying for all that server traffic when you are providing an online service with your app or game! Apple introduced in-app billing as a way to combat piracy. Yet, blogger Dominique Bongard explains on his blog how weak these in-game purchases are.
The easiest way to fake a transaction is by creating something that manipulates the SKPaymentStatePurchased feedback from the Apple billing server. From what we understand it just states true or false and as the author explains, there is no encryption. Apple also provides a transaction ID and receipt that should help companies with creating an audit trail. This is actually the only way to somehow secure your app or game by validating them on your own server before releasing or activating purchased content or services. If that would be done on every app launch, it would directly block usage of the app when there is no internet connection available and so, block usage and create unhappy clients.
