Android App transfer to other developer

Question

There's a developer interested in purchasing one of my apps (the only one that actually have users), meaning I would need to send him the original source code, the keystore and request Google for a transfer following this link: https://support.google.com/googleplay/android-developer/answer/6230247?hl=en

The issue is: all my apps use the same certificate from the same keystore.

So my question is: Would it be possible for the new developer to hijack any of my other apps?

I believe that the answer is "No. A device would allow another apk signed with the same certificate and with the same package name to update on the device, but Google Play wouldn't allow the developer to upload another app with the same package name as any of my other apps".

But I'm not sure on that and I would like further tech details on it.

As I said, the other apps I have are not important and I could just as well unpublish them. But I rather not, and even if I do, the question is still valid.

ps.: yeah, now I've learned that I should have 1-certificate per app.

Answer 1

The package name of your application is unique in the Play Store. It is how devices (and the Play Store) identify your application, and thus must be unique and cannot be changed. Android will not allow your users to install two applications with the same package name.

However, giving your keystore to another developer is still risky. The Play Store employs two gates when updating an application:

• First, you must have access to the account that owns the application.

• Second, you must have an APK signed with the correct keystore

By giving someone access to your keystore, you remove one of the two security checks. If the new owner of the application where to gain access to your developer account, they could re-publish the other applications as well. There's also the risk of this new owner selling the keystore and application to someone else in the future who might do the same thing.

Theoretically if your account is secure, then your other applications are also safe from hijacking.

Whether this risk is acceptable is up to you.

Answer 2

They could sign an APK and encourage your existing users to sideload it. When sideloading, the app isn't going to be able to know if it came from you or them. But the Play store itself won't let them upload an app that you haven't transferred to them.

Normally, part of the agreement when the buyer buys and app that using a key used by other apps would include a small snippet that the buyer must protect the key. This agreement would be bilateral anyways, since you could in theory hijack their users by sideloading a signed APK.