7

The Google Play Games Services guidelines state the following: "After signing in, the player must always have the option to sign out."

Imagine the following scenario:

  1. I download a mobile game and play it for a few weeks whilst authenticated
  2. During this time, I unlock levels and accumulate in-game currency (which is saved to the cloud)
  3. I decide to sign out of Google Play Games Services, but continue playing the game

I see two options for managing the player's data: 1. Copy all of their cloud-saved data to local device storage 2. Start the user over again, saving data to local storage (if they log back in, they'll get access to their cloud save data again)

The first option sounds the most logical, but it also means if the user logs back in again that I'd sync the local data back to the cloud. Therefore, a user could sign out, alter the locally-stored preferences on their device directly (e.g. add 1000000 coins), then sign back in and have that data synced.

My question is, is synchronising the data both ways the "correct" way to go about this, despite the risk of (some) players being able to tamper with their data? I've been able to find plenty of info about signing out, but not what to do afterwards.

Thanks!

2 Answers 2

4

My question is, is synchronising the data both ways the "correct" way to go about this, despite the risk of (some) players being able to tamper with their data?

Nope. Separate the score system into two:

Offline and online score.

When user sign-out, take the online score and save it to the offline score. User's offline score will continue from where user left from online score.

If you decide to sign in again, use the online score. Also update their offline score with the online score.


By doing this, you are only making it harder for players modify score. If the game is running on the player's side, the player can always change the score if they understand basic APK reverse-engineering. The data does not have to be saved in other to be altered. It can be changed in the memory. It can also be changed by decompiling, altering your code,compiling and signing the APK.


Now, if you make the game to run on the server but read input from the user then it cannot be altered unless your server is hacked.

2
  • Thanks for your response. So you're saying apply server state to local state when they sign out, but don't apply local state to server state when they sign back in? I can see that making sense. I'll experiment with a few other popular games and see if that's how they do it. Jun 23, 2017 at 5:49
  • 1
    Yes, that's what I am saying. Although, if you decide to do it your way by loading the local data to the server then build a table system that stores how player got their local score such as time+how much was given to player each time. Send this to the server when user sign-in again. Calculate it, if it makes sense then accept the score. If not reject the score and make the player use the old score from the server. I think user would prefer if you take their local score because there are honest users out there but you have to do this check.
    – Programmer
    Jun 23, 2017 at 5:53
4

This depends on the game if it is a story based game you could solve this issue by differentiating between authentic cloud saves and offline saves with a save menu as you are not limited to one save by the API. If it is a premium currency based game such 1.00$ for 100 Gems you should keep all transaction records on the server as it is not wise to allow the user any chance to alter these values.

"A game can write an arbitrary number of Saved Games for a single player, subject to user quota, so there is no hard requirement to restrict players to a single save file. ... All Saved Games are stored in your players' Google Drive Application Data Folder. This folder can only be read and written by your game - it cannot be viewed or modified by other developers’ games, so there is additional protection against data corruption. ... Saved Games are insulated from direct tampering by players so they cannot modify individual Saved Games. ... In general, the best way to avoid data conflicts is to always load the latest data from the service when your application starts up or resumes, and save data to the service with reasonable frequency. ... Your application should make every effort to handle conflicts such that your users' data is preserved and that they have a good experience."

here is a link with more information.

3
  • Thanks for the reply. The second paragraph regarding protection is for Google Play Games Services, and I believe it's referring to a folder in the cloud, not on the players' device? I think any user can change the local game save file if they've rooted their device. In my case, my local saves would be handled by Unity's PlayerPrefs API. My game is a casual time killer (think something like Color Switch), so I don't really want the player to need to select which save to load. Jun 23, 2017 at 5:45
  • 2
    Unitys PlayerPrefs API seems to be geared towards player settings rather then saves. You could serialize the file to a binary format so its at least not human readable, and as google recommends load the latest save. That is as long as its not for a leader board, I would recommend restricting any such features unless their logged in. edit: I found this it might help link. Jun 23, 2017 at 6:17
  • Good point about PlayerPrefs. This is my first Game, so I'm still finding my way around the best practices for everything. I was indeed planning on restricting access to things like leaderboards and achievements whilst the player is signed out. Jun 23, 2017 at 6:21

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.