Keystore warning from Google Play

[Dushi]

I had been published the game on Google Play. Later I had to change computer so I screened info from Preferences -> Keystore and backuped keystore file. On new computer I loaded keystore file and filled things above(company name etc.) - everything is same like on old computer. But I created new update apk on my new computer, uploaded it to google play. The game is playable but I received warning from Google Play " Security Alert: Your app contains embedded private keys or keystore files ".
Also there is path where maybe is problem assets/keystore.keystore (I can't find this).

 

[DukeSoft]

Did you maybe add the key to your included files..?

 

[Dushi]

Yes, So It can not be there ?

 

[DukeSoft]

No! It should very much NOT be there! Thats like selling cars and giving people the keys to the factory as well.

A private key is used to encrypt stuff (or sign your package) - and its YOURS. Thats why its called a private key. Usually you have a password on a private key, but that is an _extra_ protection for if someone ever manages to steal your private key (which is pretty easy in your case).

You basically use your private key to create a lock (a kind of hash) - people can then use a PUBLIC key to check if the hash was really made with that private key.

Thats why you have a private and a public key.

I suggest you throw away your old key as fast as possible and regenerate a new keyset, and keeping the private key _private_

Read up some more here; https://www.comodo.com/resources/small-business/digital-certificates2.php

 

[Dushi]

OMG, I'm an idiot. Thank you ! By the way If I change private key do I have to completely create new application on Google play ?

 

[DukeSoft]

Not sure about that, but I think you'll need to give a new public key to google. There is probably a section with "keys" where you can "discard" the old one and put in the new one. You will then have to upload a new version built with that key, yeah.

 

[Dushi]

Ok, thank you very much!

 

[Nocturne]

OMG, I'm an idiot. Thank you ! By the way If I change private key do I have to completely create new application on Google play ?

I'm pretty sure that once an app has been signed with a key you cannot upload a new version with a different key. https://groups.google.com/forum/#!topic/android-developers/pocbQfvBdoU

 

[Dushi]

I deleted keystore file from "Included files" and updated my app but Google sent me the warning again. Where else keystore could be ? Please help, Iam really scared Google is going to delete my app.