Develop Reference

PushSharp Device ID for Android

All,
I'm probably asking a very basic question here, but how does one get your device ID for PushSharp in Android? My setup is VB.net, and we'll be sending to a large number of different Android devices.
Following the PushSharp example here is my code so far:
push.RegisterGcmService(new
GcmPushChannelSettings("YOUR Google API's Console API Access API KEY for Server Apps HERE"));
push.QueueNotification(new GcmNotification().ForDeviceRegistrationId(
"DEVICE REGISTRATION ID HERE")
.WithJson("{\"alert\":\"Hello World!\",
\"badge\":7,\"sound\":\"sound.caf\"}"));
I know the API key is from the GCM service, but where does the Device Registration ID come from? Is that setup by the GCM service? Or is that something the android device sends the server should save?
Thanks for the help.

The registration ID is assigned by the GCM service. When the application registers to GCM, it gets a registration ID and should send it to the server.
Registration ID An ID issued by the GCM servers to the Android application that allows it to receive messages. Once the Android application has the registration ID, it sends it to the 3rd-party application server, which uses it to identify each device that has registered to receive messages for a given Android application. In other words, a registration ID is tied to a particular Android application running on a particular device.
You can read more about it here.

In case you ended up reading this post and could not get yourself sorted out with the selected answer, here is the ultimate link that helped me:
Getting a GCM registration ID

google cloud messaging security

Company creates a project and receives a sender ID. Company creates an app, bakes in its sender ID and places the app in the store.
Attacker reverse engineers the app and extracts both the sender ID and the server interface used to receive GCM registration IDs.
Attacker creates his own app, bakes in Company's sender ID and server registration interface, puts app in the store. The attack app basically impersonates Company's real app as far as GCM goes: it registers to receive messages from Company's sender ID and then sends its GCM registration ID to Company's servers just like the "real" app does.
Now Company wants to broadcast some information to all instances of its app. Maybe it's a reminder than an update is available. Is there any way to differentiate the "attack app" (which registered just like the real one) from "real" versions of the Company's app?

I think from your scenario it's not possible for the attacker to send a message to the user even if he has the registration id. The company server which sends the messages they need to authenticate (OAuth2) there account first through Google. So only if the attacker knows the password of the sending party and the registration id than it can send the user. But the password of the sending party of course is never send to the client side.

well, this might even work in a debug version of the attackers app, but he can not put his app in the store. part of the GCM identification is the app id which needs to be unique in the store.

The same problem could also have existed with C2DM, which you can sniff the sender email address, instead of project ID for GCM.
C2DM or GCM, should never be used to send sensitive user information (i.e. account name, private information, etc), it's mainly useful for notification, which the real app can use it to perform further actions.
I can't see how useful a notification can be to a 'fake/hack' app, what are they going to do with 'You have new message' notification?

The GCM Registration ID is requested by Google, requested from the app and submitted to your server. When someone with a different app (but the same sender ID) creates a Regid, it still has to be committed to the server, and you first have to explicitly send a message to that specific regid.
An app installation, whether legitimate or not, can never receive messages it is not authorised for. (Provided you declare and use the C2D_MESSAGE permission)

Actually, google let's you register a Server Key for GCM, which lets you White-List Server IP's...
So you should add your server IP and you would be safe, since only your server is allowed to send messages with that key.

GCM is safe in this case.
You even can't use your Sender ID in your original app before you register the app in GoogleApiConsole. This means you point private key fingerprint in GoogleApiConsole. It's enough.

I would suggest having your own "interim server" which uses the API key (sender ID as you referred to it). Instead of embedding it in the app itself.

C2DM - Device and third party server email accounts query

Looking entirely from the user account perspective, are the following pointers to be followed for the C2DM push system to work?
Manually sign up on https://developers.google.com/android/c2dm/signup and provide package name of my android app. consider emailId given is: foo#gmail.com
Programmatically Register from my android app using a email id, foo#gmail.com
From the third party application server send push notifications. Generate the authentication token using foo#gmail.com and pass****word.
My question is, is it mandatory to provide the same emailId in all the above places?

yes Please go though the links
https://developers.google.com/android/c2dm/
Sender ID An email account associated with the application's developer. The sender ID is used in the registration process to identify a Android application that is permitted to send messages to the device. This ID is typically role-based rather than being a personal account—- for example, my-app#gmail.com.
http://www.vogella.com/articles/AndroidCloudToDeviceMessaging/article.html
http://android-developers.blogspot.in/2010/05/android-cloud-to-device-messaging.html
http://www.abolkog.com/portal/java-programming/117-android-push-notifications

Is it required device Id and Registration Id for C2DM?

I am having some problems in doing C2DM, I research a lot, but i did not get the proper way to do it. So i am asking a question.
My Questions are:
1). What is the difference between Registration Id and Device Id?
2). Is it Required both the id's for push Notification?

Registration ID
An ID issued by the C2DM servers to the Android application that
allows it to receive messages. Once the application has the
registration ID, it sends it to the third-party application server,
which uses it to identify each device that has registered to receive
messages for a given application. In other words, a registration ID is
tied to a particular application running on a particular device.
You can find the source of Registration ID here.
Device ID might be the unique identification ID of a particular device, as in IMEI/IMSI number or something of the sort.
AFAIK, both are needed to get C2DM working.

C2DM registration ID clarification

I am new to C2DM. I have few question about C2DM registration ID.
I have installed same C2DM Mobile app in two devices. Whether I will need two rigistrations ID for two devices or we need one registration ID for mobile client.
My requirement is I have to install client app in two devices and I need to notify both the devices same time when I changed data in Server.
Suggest me the RegistrtionID implementation.

each device can register separately and will receive a separate registration id. When it's received, you'll send the registration id to your application server.
However the registration id is stored on your server, you'll want to send separate notifications for each device that you want to receive a notification (as identified by its registration id).