java - Protect a DB against rooted devices -

imagine have game, need save data every user level, highscore, gold,...
if saved of these locally (on user´s device) aren´t safe , modified user rooted device , bit of skill. (as discussed here)

so need put them on database on server - i´d connect webservice , json.

but realized isn´t safer: if can apk, can decompile it, code used post highscore, , either edit post 1,234,567 (and compile again) or extract , post highscore.

in case of highscore, it´s not big problem - this, it´s possible get/post that´s used in app.

how can protect app/database against this?

my ideas:

1. encrypt post: can´t work, encryption happens on device
2. encrypt post seed db: "hacker" can seed aswell, not safer
3. generate key every connection: same first

in 1 sentence: long "hacker" can mirror behaviour of app, there way of ensuring connection db opened app , not else?

you need change approach this. if don't want user change data, don't put on device. server needs master of data in example give. use local database cache use display, sync , validate against server when can. way doesn't matter if rooted user chooses change devices database. data posted server needs come authenticated user. there no way make sure data isn't being tampered locally on users device.

decompiling app should not expose way user post data server. let user authenticate server , give him expiring ticket/token in return. @ accountmanager, , sample samplesyncadapter. official developer site has great reading well. handling user data

in general, recommend minimizing frequency of asking user credentials—to make phishing attacks more conspicuous, , less successful. instead use authorization token , refresh it.

where possible, username , password should not stored on device. instead, perform initial authentication using username , password supplied user, , use short-lived, service-specific authorization token.

also @ how signing application works make sure "approved" builds of app can communicate server.