In-app billing receiver permission
===

Background
=

I know the **receiver** in the **Dungeons manifest** (the in app billing example, for those who don't know) does **not include a permission** element, yet Lint warns me: *"Exported receiver does not require permission (...) Without this, any application can use this receiver"*.

If I understood this right, an application could spoof me with fake data (perhaps in a crafted system, not sure), possibly impersonating the Play application and supplying faked billing records.

Questions
=

 1. **Is that right? What are the implications in a regular, consumer Android device?**

 1. **What I should write into that to expect normal behavior?** Which I presume is allowing my receiver to only receive broadcasts from a legitimate Play app. Is it `com.android.vending.BILLING`? In this case, I think a spoofed system can possibly declare that. That leads to 3:

 3. Should I also compare to well known Google public signatures, to avoid a spoofed system?

Comments
=

I know some of this may seem too much for some, yet I'm thinking about the theory here. :-)

Also, I don't have use for manifest-defined receivers, so I never paid much attention to them. That said, if I'm not getting it right, please correct me. Yes, I did read the documentation before and just now.

Thank you.