Question

I have two android devices that runs a gcm client app. I get the Reg IDs of both the devices. I also have a server API key. Now the thing is, Using a simple php code using cUrl or Zend framework, I’m able to send message from a web server to one of my droids (Of course I can broadcast too). But, with this in hand, is there any way to send a string from one device to another?

Answer 1

Quoting myself from my book:

You might be tempted to use GCM for peer-to-peer messaging, without a server of
your own. In effect, each Android app is its own server, using the same JAR you
might use in a Web app inside your Android app to send messages to some other
party. For example, you could implement a chat system without having a dedicated
chat server.

The danger here is that this would require your API key to be embedded within
your Android application. Anyone with that API key is perfectly capable of forging
messages from you. The IP address restrictions you could place on that API key are
unlikely to help, since your legitimate uses might come from any IP address, not
just some single server. Since finding magic strings in APK files is not that difficult
for those with the inclination, putting your API key in your APK file is a dangerous
move.

Hence, you will want some server of your own as a middleman.