Best practices for saving game when user has signed out of Google Play Services?

Question

The Google Play Games Services guidelines state the following: "After signing in, the player must always have the option to sign out."

Imagine the following scenario:

1. I download a mobile game and play it for a few weeks whilst authenticated
2. During this time, I unlock levels and accumulate in-game currency (which is saved to the cloud)
3. I decide to sign out of Google Play Games Services, but continue playing the game

I see two options for managing the player's data: 1. Copy all of their cloud-saved data to local device storage 2. Start the user over again, saving data to local storage (if they log back in, they'll get access to their cloud save data again)

The first option sounds the most logical, but it also means if the user logs back in again that I'd sync the local data back to the cloud. Therefore, a user could sign out, alter the locally-stored preferences on their device directly (e.g. add 1000000 coins), then sign back in and have that data synced.

My question is, is synchronising the data both ways the "correct" way to go about this, despite the risk of (some) players being able to tamper with their data? I've been able to find plenty of info about signing out, but not what to do afterwards.

Thanks!

Answer 1

My question is, is synchronising the data both ways the "correct" way to go about this, despite the risk of (some) players being able to tamper with their data?

Nope. Separate the score system into two:

Offline and online score.

When user sign-out, take the online score and save it to the offline score. User's offline score will continue from where user left from online score.

If you decide to sign in again, use the online score. Also update their offline score with the online score.

---

By doing this, you are only making it harder for players modify score. If the game is running on the player's side, the player can always change the score if they understand basic APK reverse-engineering. The data does not have to be saved in other to be altered. It can be changed in the memory. It can also be changed by decompiling, altering your code,compiling and signing the APK.

---

Now, if you make the game to run on the server but read input from the user then it cannot be altered unless your server is hacked.