App permissions: Google Play license check

proBro

Hi,
I have noticed that some apps have started to include the permission "Google Play license check" which you can see listed under App info - Permissions - All permissions (at the bottom) if present.

This permission requires Sandboxed Google Play to be logged in to work. The app refuses to start and won't work otherwise, closing itself with just Google Play opened.

Is it possible to route this check differently to get around this? The apps I use are free and downloaded anonymously from Aurora Store.

Apps found so far:

ChatGPT (com.openai.chatgpt)
Euronews (com.euronews.check)
Wikipedia in recent release(s), now removed (org.wikipedia)

I don't know why this license check is needed in apps where the cost, if any at all, is regulated by the internal account subscription (like ChatGTP). It is worrying if it becomes a trend or best practice to include the license check among dev.

Would it be possible to route the check sandboxed, towards the app installation source or store the license of such apps locally on install?

other8026

proBro

It's possible for apps to do the license check client side, but Google/Android docs suggest app developers use server side license checks.

Warning: When your app performs the license verification process on the client side, it's easier for potential attackers to modify or remove the logic associated with this verification process.

For this reason, we strongly encourage you to perform server-side license verification instead.

source https://developer.android.com/google/play/licensing/client-side-verification

It's probably not possible to reroute anything since apps would expect signed responses from Google Play for verification:

When an application checks the licensing status, the Google Play server signs the licensing status response using a key pair that is uniquely associated with the application.

source: https://developer.android.com/google/play/licensing

I'd suggest you browse through the links above and also this one for more info. It all boils down to client side checks can be spoofed, while server side checks (probably) can't.

proBro

other8026

Thank you for clarifying. I am no longer worried that the license check will be a standardized implementation among apps.