java - What are consequences of having GCM SENDER ID being exposed? -

scenario: suppose reverse engineering .apk file, attacker obtains sender id push registration service used in app. attacker develops similar fake application has same/different package name , has been uploaded on different app store google play.

my question: can he/she use same sender id app? implications of user installs fake application?

related questions: google cloud messaging security question seems bit similar. answer of android gcm: same sender id more application question provides valuable information. reading both accepted answers conclusion seems absolutely possible , that's why recommended not have sensitive data in push messages.

but doesn't seem solution problem. unable understand effect of above security lapse.

a sender id (aka google api project id) not tied unique application package name. in fact, multiple apps can register gcm using same sender id, allow same api key used sending gcm messages of these apps. of course each app have different registration id (even when on same device).

if knows sender id, can register gcm sender id, without knowing api key won't able send gcm messages either fake app or real app. when register gcm, gcm receives package id of fake app. therefore if send message registration id of real app, won't reach fake app. in order fake app messages server, need send own registration id server , fool server believing it's real app. in our server application have mention our api key. if want send notifications needed.