Live data from Hacker News

Simple And Safe In-App Purchase Using Parse

blog.parse.com

21–22 of 22 posts

Re: Simple And Safe In-App Purchase Using Parse

#21
Does Parse validate the SSL certificate in a way that can't be patched at runtime? If not, it's just as possible to selectively spoof the Parse request as the Apple request.

Sorry, but untrusted hardware can always win. For a case study of how hard this is to get right, see Microsoft's Xbox 360 and note that it was still fully compromised at least once.

Re: Simple And Safe In-App Purchase Using Parse

#22
post #19

Earlier quoted context omitted.

Most of the jail broken cracks are trivial to detect client side. Otherwise... They aren't going to pay anyway, might as well make the experience better for payers and not block on validation( but still track invalid transactions). And besides, if they're willing to install a hackers DNS server and ssl cert, they won't have money for long.

I agree. The hackers will only be a small percentage of your user base (guessing <=5%), if you have a problem at all. This issue is more problematic if you track revenue metrics, and so JB users may inflate your numbers considerably, if you're not cognizant.

> The hackers will only be a small percentage of your user base (guessing

Not if you're making a game for teenage boys.

Post reply on HN