Hello, we're trying to implement server side validation of google android iaps, and I'm reading the google's recomendation on security:
http://developer.android.com/google/play/billing/billing_best_practices.html
One thing they're saying is: " If you do offload security processing to a remote server, be sure that the device-server handshake is secure."
My question is whether the handshake of devices with Shephertz servers are secure?
Thanks!