Rendered at 14:22:34 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
axegon_ 1 days ago [-]
This is arguably the most irritating thing with just about every largecorp developer: "os that hasn't been updated in 6 years? Sure boss!". Os that is built specifically around security and privacy with daily updates: "No, you can't do that". Annoying - yes. Safe way to make sure I will stop being your customer - also YES!
fluidcruft 1 days ago [-]
Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors).
Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good guy or a bad guy so it's easier to just ban guns.
axegon_ 1 days ago [-]
That's your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don't have to legally be adult to buy any of the things you'd need and I say that as someone who only struggled with chemistry in school, that's now low the bar is. What's the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronomically lower than any Chinese spyware-infested phone.
yonatan8070 6 minutes ago [-]
Their problem is that stock Android doesn't allow the user to muck around with the insides of apps, and will make it harder for you to trick the PayPal app, while a custom ROM gives you full control to do unfriendly things to the app like reverse-engineering, inspecting it at runtime, and messing around with its internal state.
Edit to clarify: I don't say I agree with that, I believe that if they don't want you messing around inside their app, then they shouldn't ask to be on your device.
HenriTEL 23 hours ago [-]
The problem here seems to be that the phone is detected as rooted, not specifically that it's running grapheneOS.
But I agree that it's a big problem. That's how you end up in a situation where google has full control from hardware to final apps like on iphones.
When devs assume that everybody is using the stock android with google services enabled.
ryandrake 12 hours ago [-]
How did we let "rooting" become some evil thing?
It's normal to have root (or Administrator) on your devices. After all, they are yours. They don't belong to the device manufacturer. You should have full access to your own devices by default.
Only recently did we somehow normalize the idea that the user should not be the ultimate decider over their own devices.
6510 5 hours ago [-]
We've already progressed from "the user should not be" to "the user should never be". Perhaps we will even grow out of calling it "their own devices" eventually. If they can brick it remotely it kinda already isn't really yours?
svpk 22 hours ago [-]
GrapheneOS is not rooted. The phone not being rooted is part of the GrapheneOS' security model.
I assume the issue is it failing the deeper play integrity check which is about it not being "Google approved."
grapheneos 10 hours ago [-]
It isn't due to the Play Integrity API. That shows a notification on GrapheneOS with a toggle for blocking it to work around it for services not enforcing providing a result. If that was the issue, the original poster would have known from the notification. The issue ended up being PayPal shipping incorrect anti-tampering code incompatible with secure spawning. The original poster figured that out and got it working by disabling the per-app secure spawning toggle.
Melatonic 22 hours ago [-]
[flagged]
grapheneos 10 hours ago [-]
It does not have a root privilege mode. GrapheneOS doesn't weaken any aspect of the standard security model. It has all of the standard security model and features including hardware-based security intact. It greatly improves security rather than doing that.
User accessible root access is available in userdebug (non-production) builds. There's no system for granting root access to apps. It's no different from the stock OS in this regard, but it's a lot more secure than the stock OS.
nulld3v 16 hours ago [-]
[flagged]
iugtmkbdfil834 23 hours ago [-]
Parent has a point by playing devil's advocate. Practical considerations indicate that platform is gonna platform. Solution here to greed driven development is some level of 'non possumus' from the general public. Sadly, I am starting to think is what we really need is a lot of valve like companies, where company stay private, founder is not a complete asshole and so on. Tall order, but that is the only real way to reverse some of the damage. I am done counting on the public to see light.
pkulak 24 hours ago [-]
It was an analogy, or metaphor, I forget the distinction. But I don't think it was stood up to be literally argued against though.
rc5150 20 hours ago [-]
then it was a bad analogy.
robocat 13 hours ago [-]
Do you like science?
I propose you buy enough ingredients from the supermarket and make a big batch.
The scientific test is: how far do you get, before your door is kicked in?
If that fails, then science #2: have fun lighting it!!
You almost win both ways. (although I admit I wouldn't fund you even via a trustworthy intermediary say a Kickstarter campaign.
john_strinlai 24 hours ago [-]
physical risks, like your example, do not map well to digital risks faced by large international companies.
axegon_ 23 hours ago [-]
It was a response to the gun example which is a physical risk. My argument is that Paypal (much like all other tech-bro companies) are incompetent. The incompetence grows exponentially the larger a software company is. I speak of experience.
On a side note, if you want to be extremely specific, the line between the physical and digital threat does not exist anymore. There are two things people need to be afraid of: incompetent friends and competent enemies. Tech giants are already filled to the brim with incompetent friends, which drastically lowers the bar for the competence of their enemies.
sieabahlpark 13 hours ago [-]
[dead]
grapheneos 10 hours ago [-]
There's no tension between the security of PayPal against bad actors and support for GrapheneOS. GrapheneOS preserves the whole standard security model and greatly improves security. It's far more secure than anything permitted by the Play Integrity API device or strong integrity levels.
Thankfully, PayPal hasn't banned GrapheneOS and their app still works on it. They accidentally broke compatibility with our secure app spawning feature which has a per-app toggle to disable it along with the other exploit protections which can cause compatibility issues.
There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.
brightball 1 days ago [-]
Yea, years ago I was in the security space and got to talk to some paypal security folks at a symposium in San Diego. The level of stuff that they have to deal with is so extreme.
It's similar to how people don't like sites blocking entire countries or access from Tor, etc. You might be doing it for privacy...but all the people trying to commit fraud are also using those same channels to hide their identity. The blockades are one piece of a holistic security picture that frustrate the well intentioned users.
xelxebar 15 hours ago [-]
This is interesting. You're gesturing at the idea that individual security practices can be at odds with those needed for group security. I'll be pondering on this.
axegon_ 1 days ago [-]
Yet another weak point. My question stands: A user with an OS from 2019 is "secure" and dozens of unpatched CVEs but a literally-last-night-patch OS is not? That's the "stuff they have to deal with"? I was lucky and did not make the mistake of joining a payment provider in 2020 or 2021 (I can't remember). The reality is that European laws are much harsher when it comes to payments and personal data protection and the security team I was being interviewed for was catastrophic(big part of the reason I did the "I accepted another offer already, sorry" card).
As for geo fencing or blocking Tor... HAH! As if that's ever stopped anyone with the will. That is the last concern of anyone with a malicious intent. Sure, it stops irritating kids but no one beyond that.
The simple fact is that cybersecurity was in an abysmal state before the slopification began and it's infinitely worse now. Paypal is no different given that much of their support has been outsourced to slop machines. Punishing the users that know what they are doing while rewarding the ones that don't is the most counter-productive and detrimental crap anyone could come up with.
a2ff6eeb0 23 hours ago [-]
Yeah, they can track and profile the old os, and feed the data to the risk models.
It's not about user security.
brightball 23 hours ago [-]
I don't run their business. Just trying to explain.
From what we see above it sounds like the change trips their rootkit detection, which they are probably interpreting as a compromised device.
It sounds like you're expecting them to have a perfect security posture that can correctly identify fraud in call cases and only block the real thing. It's more complicated than that and there's typically some type of scoring system involved with numerous triggers that are higher value indicators of potential fraud. If they think the device is compromised, that's probably a high value indicator.
This is just me speculating.
browningstreet 1 days ago [-]
> That's the "stuff they have to deal with"?
No. It's the offensive fraud vector coming from unsecured devices that account for a significant portion of the noise. Requiring device profiling aggravates this vector.
axegon_ 1 days ago [-]
> unsecured devices that account for a significant portion of the noise. Requiring device profiling aggravates this vector.
Bullshit! Source:
> The reality is that European laws are much harsher when it comes to payments and personal data protection and the security team I was being interviewed for was catastrophic
Sounds like someone who wanted to impress the audience with fluffed up claims.
Zedfragg 22 hours ago [-]
It's comments like yours that remind me of an important lesson.
Just because you argue with vigor and intent, it doesn't make you right.
People are offering their opinions, try not being a dick about it.
GrapheneOS is a privacy orientated OS which is great.
But if the vectors to achieve privacy are the same as used by bad actors, I'd block it too.
Get over it, don't like it? Use a different product.
Or make a better one.
RunSet 24 hours ago [-]
> Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies.
A more apt analogy might be game developers who demand admin rights so they can install a rootkit to detect "cheating".
BobaFloutist 21 hours ago [-]
They wouldn't do that if there weren't market demand. Competitive games lose their appeal when cheating becomes too prevalent.
Similarly, payment processors lose their appeal if they can't prevent people stealing your money, or spending stolen money on your products.
kevin_thibedeau 1 days ago [-]
The cherry on top is that their web site invariably still works so the refusal to work via app is an intentional manipulation tactic to harvest more consumer data for sale.
fluidcruft 23 hours ago [-]
I'm fairly skeptical the website supports NFC payments.
gvurrdon 24 hours ago [-]
Sadly, their website now appears to require an app in order to sign in.
Even before that it would often block me with text along the lines of "We don't know who you are, call our support number."
kevin_thibedeau 24 hours ago [-]
Desktop mode fixes discrimination against small viewports.
gvurrdon 23 hours ago [-]
This was happening to me on the desktop. I've not tried on a phone (I try to avoid PayPal).
HeyLaughingBoy 21 hours ago [-]
PayPal? I sign in all the time. If you're referring to the popup to add a new authentication method, you can just escape past it.
wolvoleo 20 hours ago [-]
I think the issue is more that big tech only trusts their own kind and usually has motives to exclude privacy conscious software because they can't datamine it or make backroom exclusivity deals.
The needs of the user don't matter to them at all.
dmichulke 1 days ago [-]
To stay with your analogy, there is no technical obstacle to treating the customer of 15 years differently to the newly onboarded one.
They have all the data they need, and they choose not to use it.
fluidcruft 1 days ago [-]
The analogy was not about new vs old customers being allowed to have guns.
I think that's a limitation of the analogy because there is no correspondence with trusted computing. I guess it would be some sort of a magical gun that some other company is endorsing as of limited use during bank robberies? Maybe like some sort of RFID thing that disables the gun when inside a bank?
Anyway it really stretches the analogy to get tied up in technical details (risks missing the forest for the trees type error).
encom 1 days ago [-]
How does a rooted phone enable bank fraud? This smells like pointless policy checkboxing.
biosboiii 1 days ago [-]
If you run a rooted phone and download malware, that malware can gain root and do payments on your behalf.
Then PayPal has to deal with you revoking payments etc., they don't want to so they forbid you from using PayPal on a rooted phone.
ruszki 1 days ago [-]
Malwares can possibly do that even on non rooted phones if a privilege escalation attack is possible. And just yesterday, there was an article here about exactly one of those.
Also I highly doubt that there is any real statistics anywhere about whether this is a real threat or not. I guarantee that nobody did such statistics properly. The only known data is from companies which sell root prevention tools, so totally unreliable. And internally I guarantee, that no banks collect such info.
So no, banks lie about this only because they can sell this to judges as safety feature, when they fuck up, which happens continuously.
fylo 1 days ago [-]
Graphene isn't rooted.
Grombobulous 1 days ago [-]
Not only is it not rooted, it runs real Google Play services. It’s not microG.
yjftsjthsd-h 20 hours ago [-]
If you have a rooted phone, download malware, and hit the allow button to give the malware root access, then it can do whatever it wants.
If you have a nominally unrooted phone on an old Android version and download malware, it can exploit a kernel bug and give itself root access and do whatever it wants.
Protecting against the first case and not the second is at best security theater.
master-lincoln 1 days ago [-]
If this happens it's the device owners fault and they should be responsible for it.
Grombobulous 1 days ago [-]
Which they would be anyway since PayPal isn’t a bank and isn’t FDIC insured.
They allow you to open PayPal.com on any web browser. Running Windows/macOS/Linux is basically identical to a rooted Android phone (you have local admin rights, you can modify and automate the browser, and can run unsigned code).
bayindirh 1 days ago [-]
No, no...
In 2026, all footguns are banned. Even in programming, so if something allows a footgun, it's banned now.
Apparently the world can't adult and be responsible for their actions, or people believe in that.
1 days ago [-]
encom 1 days ago [-]
For that argument to hold, they'd also have to blacklist any phone not running the newest, most up to date Android version, because all older versions presumably have known exploits. So that basically leaves Pixel phones.
iamnothere 1 days ago [-]
Graphene OS does not support root. This is a false positive based on some check they are doing.
fluidcruft 1 days ago [-]
It's probably just a generic error message for failing that Google Play Protect thingamajigger that attests provenance of the vendor OS from boot. Will be interesting to see whether the Motorola phones have this endorsement when they ship. Most devices would probably fail because they are rooted rather than because they are GrapheneOS. I wouldn't put it past a scammer talking grandma into rooting their phone.
grapheneos 10 hours ago [-]
It isn't due to the Play Integrity API. That shows a notification on GrapheneOS with a toggle for blocking it to work around it for services not enforcing providing a result. If that was the issue, the original poster would have known from the notification. The issue ended up being PayPal shipping incorrect anti-tampering code incompatible with secure spawning. The original poster figured that out and got it working by disabling the per-app secure spawning toggle.
fluidcruft 2 hours ago [-]
Thank you for the clarification!
br0ceph 21 hours ago [-]
[flagged]
grapheneos 10 hours ago [-]
It will be possible to install the official GrapheneOS on the devices. Shipping devices with the official GrapheneOS is planned but may not be there at launch.
goonersallofyou 1 days ago [-]
One thing that I'm actually excited about regarding AI is that the pointless policy checkboxes that have never been effective in adding any actual security are even less so effective now that everyone can wield their very own security researcher.
edoceo 23 hours ago [-]
PHB at insurance company will still need them, so any company they insure will need them. Theater continues, the show must go on.
DANmode 22 hours ago [-]
This might make sense if you trusted clients,
and if GrapheneOS was a root-having OS.
dathinab 1 days ago [-]
this isn't quite true
From a Paypal security POV, weather you use "custom Android OS" or an hugely outdated Android phone, you have:
- a similar risk for the "you" want to mess with Paypal case, in both cases the "you" can technically most likely mess with anything including the "virtual secure module" thingy android uses for NFC
- a lower risk for "others" wanting to mess with Paypal through your phone, at least if "custom Android OS" is GrapheneOS or another up-to-date android fork with decent security handling
so as far as I can tell, this inconsistency is very clearly not about PayPal's security.
IMHO it's about two other things:
1. marketing, if PayPal doesn't work on Android they lose customers, GrapheneOS for now has a tool small customer base for them to care. Outdated Android phone do have a large customer base.
2. compliance/politics BS. including potentially involving insurance. Compliance is mostly about checking of tickmarks(1) on outdated Android they can check them off and blame the user, Goodle or "hackers" for the issue. On GraphemeOS they have a harder time checking it of. Add the smaller user base and end up with PayPal doesn't care. Also iff things go wrong with Paypal on GraphemeOS in a public manner you will have all the "crime os" bad news bs, you won't have that if things go wrong with a even more risky highly outdated Android phone.
-----------------------
I got a bit to much off topic below:
(^1): Technically compliance should be about building robust, secure, law compliant systems and "showing" that by being able to pass a compliance tests consisting about a bunch of requirements. Practically there is way to many ways you can be "fully compliant" (on paper) but not secure and "very secure" but not compliant (wrt. security regulations). In the former case this might still come back and bite you iff you get sued or people suing which should get right don't get it because of ad-absurbum reasoning like "they comply with security regulations, hence can't have acted negligent". It's a shit show I don't know how to fix even if I could just magically change laws as compliance rules need technological flexibility, but if you give them that that will be abused to make insecure things pass. And the whole industry around checking that isn't really one who cares about actual security, sometimes outright corrupt (like groups which have the necessary accredited to check your compliance, are strangely more expensive then other groups, and somehow find less issues in average, with some excuse of why that isn't strange ...) :/
---
Lastly similar to how Teams or Slack could easily support FF (^2) but not only don't but outright refuse to try to even work. PayPal likes to act similar and doesn't care about niches. E.g. at least on some Mobile browsers WebAuthn works, but the PayPal website refuses to _even try_ 2FA with WebAuthn on mobile no matter if the APIs are there or not.
(^2): Yes there are some challenges, AFIK especially in certain edge cases most user might never run into. But Jitsi made it work, other smaller apps also made it work. And Jitsi is open source, so they technically can "look up" all the tricks to make it work (algorithmic ticks, not copy-pasting code) or outright just use their system with an appropriate contract (probably would be even cheaper wrt. maintenance cost then building your own system). At Slack/MS Teams scale that behavior is just messed up.
akimbostrawman 22 hours ago [-]
Paypal's security? the same "security" which in 2026 still does no allow a passwords above 32 character (which most likely indicating that they don't hash passwords)?
grapheneos 10 hours ago [-]
PayPal app still works on GrapheneOS.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
The first thing to try when an app doesn't work is trying the per-app exploit protection compatibility mode. That sets all the per-app exploit protection toggles to the compatibility mode. If that works which is likely the problem, it can be narrowed down.
Nearly all Android apps are compatible with GrapheneOS. The exception are around 10% of banking and government apps which use the Play Integrity API to ban using a non-Google-approved device or OS. That's visible to users on GrapheneOS via a Play Integrity API usage notification. After the first use by an app, GrapheneOS provides a menu for blocking using the Play Integrity API which sometimes gets apps working because many don't enforce it working. It's not fully reliable and can have downtime so apps often don't enforce providing a result.
factorialboy 2 hours ago [-]
The largeCorp developer and their PM are many orgs and layers away from where these decisions are mandated.
matheusmoreira 1 days ago [-]
It was never about your security, it was about the corporation's security from you!
xnx 23 hours ago [-]
Might be more a matter of "OS with millions of users" vs. "OS with dozens of users".
fmajid 21 hours ago [-]
Revolut pulled that stunt, I cancelled my account with them.
axegon_ 19 hours ago [-]
This one is pretty interesting. I was ready to cancel my account on the spot when the news popped up but it still works on my phone. And I've updated the app as many times as they've made a release since the announcement. I honestly haven't got a clue what is going on with them.
1vuio0pswjnm7 22 hours ago [-]
With Silicon Valley "largecorp" the required "security" is to protect the company from (a) the privacy-conscious user who would object to the company's data collection, surveilllance or ads/tracking and (b) from competitors, i.e., other companies that would potentially do data collection, surveillance, advertising services if they had uncontrolled access to largecorp's users
"OS that user compiled herself" can avoid this nonsense
No "smallcorp" is safe from Silicon Valley "largecorp" for long with the amounts of money SV largecorp can, and will, offer smallcorp if smallcorp grows. SillyCon Valley "largecorp" wants data about/from users, not users' money
"Safe way to make sure I'll stop being your customer - also YES!"
The user is not SV largecorp's customer
RobotToaster 22 hours ago [-]
It's not about protecting your security, it's about protecting the "security" of corporate profits.
exe34 22 hours ago [-]
The safety isn't for you, it's for the companies who want your data without you getting in the way.
tonyhart7 1 days ago [-]
"Safe way to make sure I will stop being your customer - also YES!"
I don't think they care at all about the size of graphene os market share
if its jeopardize entire userbase then its not worth it
axegon_ 1 days ago [-]
Fine by me. My example illustrates their incompetence if they are willing to let a user with an OS that hasn't received any updates in half a decade, then clearly, they don't give a single crap about security.
tonyhart7 1 days ago [-]
Noo, it’s the other way around lmao.
A financial security audit is one of the most thorough security audits you can ask for in software.
GrapheneOS gets blocked because it doesn’t follow the secure system requirements (root).
axegon_ 1 days ago [-]
I suggest you read up the graphene documentation.
inexcf 1 days ago [-]
What requirements does it not follow?
>(root)
GrapheneOS is not rooted.
nekusar 22 hours ago [-]
Yep, GrapheneOS is anti-user-freedom.
They do their damndest to prevent owners from having full control of their property, over claims of 'insecurity'.
And complaints of this nature get inane drivel responses of "lol just fork Graphene"
DANmode 22 hours ago [-]
> GrapheneOS is anti-user-freedom.
This is a really, really poor-quality take.
> complaints of this nature get inane drivel responses of "lol just fork Graphene"
It’s a fork of AOSP, which you can just…use.
nekusar 22 hours ago [-]
Uh, no. Shaming a "take" is just tone policing. Owners should own the hardware along with the software both.
Its only since the smartphone era (2008) with locked down shit devices has this view changed. And people challenging this are somehow defective, tone policed, shamed, or likewise.
GrapheneOS users are treated as 'rooted phones', at the exact same time tools that would attack and prevent corporate surveillance (xprivacy, etc) are withheld cause they would involve root.
You shared your opinion, someone else shared there’s that just so happened to be “I disagree with you” and suddenly that’s some type of censorship? Nobody is shaming you, either.
DANmode 21 hours ago [-]
> prevent corporate surveillance
Leave the abusive relationship with those entities. Don’t lay this at the feet of the GrapheneOS Project.
If you read their FAQ, you’ll see how limited the OS actually is in retaining your privacy if you still insist on using these providers that don’t respect you.
Said another way: stop trying to solve human problems with technical means.
and definitely stop trying to get others to do it for you for free.
Or, continue: I’m not a cop.
21 hours ago [-]
DANmode 21 hours ago [-]
Nobody’s shaming you, reddit refugee.
It is a common userspace decision to lock things to userspace. It’s good hygiene.
If you want less-secure software, use AOSP or one of its many forks.
You’re not defective: you just have different needs and threat model,
and you’re harassing and degrading the public image of a project that’s opinionated in a very welcome way by folks in the security community - especially those who value stability and usability.
dingaling 19 hours ago [-]
"It is a common userspace decision to lock things to userspace"
Yes, running in userspace for the majority of tasks is good hygiene.
Preventing the user from ever escalating beyond that layer on their own devices, however, is restricting their freedom to control their device. When that happens with tractors, cars or other gadgets that's considered anti-user. The same attitude should extend to phones.
DANmode 18 hours ago [-]
You can wipe the device and reinstall whatever at any time.
You have complete control of the device.
You choose to lock certain things when using GrapheneOS. That’s their security model.
If you want to argue that, go study it and argue that.
If your threat model is different, if your desired security model is different, then: it’s not for you, use one of many other options.
Like all software projects, it doesn’t necessarily exist for you - or anyone specifically.
It’s not harming you for it to exist.
nekusar 17 hours ago [-]
[flagged]
DANmode 13 hours ago [-]
Hey, stop wrecking my favorite community with non-debates, it’s done better here.
As several others have already said here, GrapheneOS is not necessarily rooted. So that's a lie.
Also, I've seen such audits internally, and they don't care about security at all. They care about the theatrics of security waaaaay more.
For example, I was at Santander in 2024, during its huge data breach. Here is the list of actions which are supposed to prevent the same kind of attacks again in the future:
-
Yeah, it's an empty list.
But of course, they made our life more difficult. In the end, I literally had more permission than before, because they were even sloppier than before. But of course, I had to change my password more frequently, and I had to type it about 5x more.
fluidcruft 23 hours ago [-]
Audits are primarily about liability and safe harbors in lawsuits. Companies get audits on record so that if something happens they have someone to throw under the bus and pass damages off onto.
ravenstine 21 hours ago [-]
With the way today's economy works, they probably wouldn't even care if they lost 1/4 of their customers in just one year. Maybe their share price would jump!
dylan604 1 days ago [-]
I'm sure their automatic bans have happened to more people than the number of grapheneOS users
zerof1l 1 days ago [-]
I see this happen from time to time. Lately, almost all of the apps work fine on GrapheneOS. The best strategy is to keep writing the business once every two or so weeks that you can’t log in to and use the app. Don’t go too technical at first, because most of the time, the moment they hear things like “rooted” or “unofficial,” they just say your phone is the issue. To date, I was able to convince, or at least contribute to, making three apps work on GOS.
dvoros 1 days ago [-]
I had the same experience. Asked in an email why an important government app won't work on GrapheneOS, first without any technical details. Got the response that it's "because security". I sent some technical details and argued that they're denying service to their most security-conscious users. 3 months later the app started to work!
dinfinity 21 hours ago [-]
To be fair, governments might be much more receptive to the argument of not having to rely on (possibly foreign) megacorporations than a company like Paypal.
I'd wager that if it doesn't really hurt their bottom line to not support GrapheneOS, they won't really care.
basilikum 1 days ago [-]
Great job, man. We have to make ourselves get heard. It's a social problem after all. Technical workarounds are great and sometimes the only practical short term option, but we have to fix the social issue at the root.
microtonal 24 hours ago [-]
I think in this case it's also them just introducing a new check that either GrapheneOS will need to work around or Paypal needs to refine. I can reproduce the issue, but it doesn't seem like it did a failed Play Integrity check at that point.
lta 21 hours ago [-]
Would you mind elaborating a bit on your process ? Or share a few relevant exchanges, I've no clue how to start having this discussion.
That would make a great blog post
cromka 21 hours ago [-]
My backwards bank blocked my mobile app access after detecting Debugging was enabled in the system. Have to call them to unlock it. I could download that APK and disassembly it with an LLM in 20 minutes, but sure, a Debug mode prevents something.
Groxx 23 hours ago [-]
Honestly there's a decent chance they don't even know, in most cases, because corporate environments generally try hard to have as few as possible hardware/software setups to maintain. And they're unlikely to proactively test on Graphene unless it's closely related to what they do (and it definitely is not for most apps).
Mistakes happen and ya can't fix what you don't know about. Always report issues.
Also strongly consider just using the website.
downrightmike 21 hours ago [-]
Which is the opposite reaction for PC problems, because people actually have choice and historically don't accept malware being the default
StrLght 1 days ago [-]
Still works for me.
I had to update exploit protection after their latest update — I think it was enabling dynamic code loading via both memory and storage that did the trick.
Edit: checked now, I have also disabled secure app spawning.
Retr0id 1 days ago [-]
Interesting, just inferring from that it sounds like GrapheneOS's actual-security features might have been tripping up PayPal's root-detection "security" features.
(Rather than something fundamentally incompatible, like them using Play Integrity)
StrLght 1 days ago [-]
There are valid RASP techniques that involve dynamic code loading, so it actually makes a lot of sense. Source: I worked on RASP a long time ago :)
IMO headline is very misleading, and OP should have tried disabling all exploit protection options before jumping to any conclusions. PayPal isn't actively trying to block GrapheneOS as of now.
skinfaxi 1 days ago [-]
So to use paypal you actually have to reduce the security of the phone?
grapheneos 10 hours ago [-]
In this case, it only reduces the security of the app against exploits rather than the security of the OS. Secure spawning protects the app via unique ASLR bases, random memory tags, etc. Blocking dynamic code loading prevents common accidental vulnerabilities via insecure code loading and hardens against certain exploit techniques.
StrLght 1 days ago [-]
As with all things about security — it depends on your threat model.
It reduces security of the app itself, but doesn't affect security of the phone by much.
water-drummer 18 hours ago [-]
[flagged]
iamnothere 1 days ago [-]
Not too surprising. I usually have to reduce my browser security on the rare occasion that I access PayPal via the web.
codethief 20 hours ago [-]
Still works for me, too, and I haven't disabled any of Graphene's security features.
grapheneos 10 hours ago [-]
Based on user reports, there are recent updates to PayPal requiring disabling the per-app secure spawning toggle. It already required not enabling some of the other protections which are opt-in for user installed apps.
Secure spawning doesn't cause compatibility issues with non-buggy apps (unlike blocking dynamic code loading via memory/storage or native debugging) and apps rarely have issues with it (unlike memory tagging, which finds lots of bugs) so it's on by default.
leumon 1 days ago [-]
Update: it seems to work when disabling "secure app spawning" (for now)
zvmaz 1 days ago [-]
So it's not PayPal blocking GrapheneOS?
zem 21 hours ago [-]
sounds more like grapheneos blocking paypal!
grapheneos 11 hours ago [-]
No, they added incorrect anti-tampering code. It's wrongly detecting secure app spawning giving each app their own address space, memory tags, etc. via exec as tampering.
paperscissors 1 days ago [-]
Great to know, thanks!
ttouch 1 days ago [-]
thank you!
shaky-carrousel 1 days ago [-]
It works here. Running in a work profile, no contactless payments.
Play Integrity API: Not blocked
Hardened memory allocator: Enabled
Memory tagging: Enabled
Extended virtual address space: Enabled
Secure app spawning: Enabled
Native code debugging: Allowed
WebView JIT: Disabled
Dynamic code loading via memory: Allowed
Dynamic code loading via storage: Allowed
dathinab 1 days ago [-]
> no contactless payments.
I think this is the problem here.
A lot of NFC related tech is deeply rooted in having "trusted (aka large company)", "attested (aka you can't easily lie)", secure module functionality.
What should have happened is to just not enable the contactless payment functionality for given app, even if the user enabled it in general. And not crash.
Also as others have pointed out, this might be an accidental mishap not an intended outcome.
But it's not like PayPal is known to care about small user-base edge cases (quite the opposite). Which I guess is the actual root problem.
grapheneos 10 hours ago [-]
The issue turned out to be PayPal adding incorrect anti-tampering code incompatible with our secure app spawning feature. It's common for anti-tampering code to break real security features. It's a major reason for us having the per-app compatibility mode toggle and the finer-grained toggles for the individual exploit protections known to be incompatible with certain apps,
microtonal 24 hours ago [-]
Doesn't work here. No contactless payments, full Exploit protection compatibility mode.
shaky-carrousel 23 hours ago [-]
This is the PayPal version I have installed that works:
Version 8.107.0
com.paypal.android.p2pmobile
microtonal 22 hours ago [-]
Looks like I have 10.10.0. They'll most likely remove support for older versions server-side at some point.
super256 22 hours ago [-]
I do have Version 10.10.0 since today and it also started crashing on open. Guess I'll have to downgrade to an older version for the time being.
shaky-carrousel 18 hours ago [-]
That's weird because I keep all my apps to the latest version and still that's the version Google serves to me as the latest. Must be a regional thing.
This is my setup as well, though with JIT enabled (which is the default). Crashing at launch on:
version 10.10.0
com.paypal.android.p2pmobile
versionCode 1160090162
Seems pretty likely a flawed root detection being rolled out (given the stack trace), my phone is not rooted.
grapheneos 10 hours ago [-]
The issue turned out to be PayPal adding incorrect anti-tampering code incompatible with our secure app spawning feature.
sdcfgy 1 days ago [-]
I'm starting to see these restrictions as a deterrent for using the products in question. My GOS handset is slowly fizzling away into a dumbphone with Firefox, organic maps and k9. And you know what, I am starting like it.
grapheneos 10 hours ago [-]
The vast majority of Android apps work on GrapheneOS. App compatibility is not diminishing in any significant way. We've improved app compatibility faster than Play Integrity API adoption has happen, which this isn't.
PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.
sdcfgy 8 hours ago [-]
Thanks for the reply. Your efforts are more than appreciated!
enos_feedler 1 days ago [-]
I have never been a crypto currency advocate, but if the banking utility of a mobile phone is going to be dictated by the operating systems that finance apps whitelist, I might want open rails that work with my open phone
ThomasGlanzmann 1 days ago [-]
I'm on Debian Testing sometimes on amd64 and sometimes on m1. Paypal also doesn't like me. Than I have two options: I use a Windows VM to do the payment or I use another payment method. Most of the time I use the other payment method.
Wero is not a PayPal alternative. It doesn't even have buyer's protection and every bank must manually implement it which immediately makes it a failure. Some banks also connect it to your phone number so you can't link Wero to two different bank accounts with the same number when you have 2 bank accounts. Very messy.
master-lincoln 1 days ago [-]
> Some banks also connect it to your phone number
What do you mean "some banks"? I thought the whole value proposition of Wero was instant bank transfers with SEPA but using phone numbers?
sunaookami 20 hours ago [-]
...why would I give my phone number to random people to pay them? I'd rather use an email address or user name. And using phone numbers means making it easier for normal people which means uploading the whole address book to the bank... just no.
Aachen 19 hours ago [-]
I'd rather give the bank account number to people that need to send money there. Why bother with email address?
sunaookami 5 hours ago [-]
With the number everyone can withdraw money (which is two clicks to cancel the transfer but still annoying).
master-lincoln 5 hours ago [-]
Source needed. AFAIK that would mean faking a direct debit mandate which would be a criminal offense.
jeroenhd 23 hours ago [-]
Wero is a payment provider technology, a money wallet, and a bank account integration technology under one single marketing name.
On the payment provider technology side, you're right, but the wallet feature uses phone numbers (and I think email addresses) so you can send each other money without sharing your IBAN (which is slightly longer and probably not in your contacts).
Aachen 19 hours ago [-]
FYI this comment was dead, not flagged. I wonder if you're hellbanned or if it was a keyword trigger
unpopularopp 1 days ago [-]
Unfortunately peasants like us who don't live in the 5 countries where it's available still can't look back
Carbon1603 1 days ago [-]
I live where it's available and still can't use it to pay stuff, only to transfer money to friends.
muvlon 1 days ago [-]
You need to use your bank's app for Wero, and many EU banks' apps refuse to run on GrapheneOS for the same reasons as PayPal. This is sadly not a clear win for Wero.
therealmarv 1 days ago [-]
wait for it... I can see a future were every wallet, payment etc. app will block devices which are on custom ROMs and do not pass strong hardware integrity with blessing from Google.
I've read once that there are paid app testing labs which test if an app has root and custom ROM detection and when they don't have that it's a minus point on the report.
Carbon1603 1 days ago [-]
Sadly, not even close. I would even dare to say that Klarna is closer to what PayPal is, than Wero.
oniony 1 days ago [-]
The website is pages and pages of blankness for me on Firefox mobile.
savwolf 1 days ago [-]
Does this work in the UK?
doublerabbit 1 days ago [-]
No. We left the EU, so we don't get such fun.
jeroenhd 23 hours ago [-]
Wero also isn't implemented EU-wide either, so it's still possible as long as the banks play ball.
UK politics has been quite isolationist, though, so I doubt the banks will see much in interoperating with the rest of Europe.
gnoll_of_gozag 1 days ago [-]
Can it still run in browser like it would on a regular pc?
grapheneos 10 hours ago [-]
Yes, but the app still works on GrapheneOS. They accidentally broke compatibility with the default settings with incorrect anti-tampering code. Disabling the per-app toggle for secure spawning works around it.
We have per-app toggles for exploit protections known to have compatibility issues. Secure spawning wasn't expected to cause any compatibility issues so we didn't have a per-app toggle for it until recently but it's available now.
qingcharles 23 hours ago [-]
Yes, but you might have to enable desktop mode on a mobile browser so it doesn't try force-spawning the app.
grapheneos 10 hours ago [-]
The app still works too. PayPal just accidentally broke compatibility with secure spawning which can be toggled off per-app. We didn't used to have a per-app toggle since it wasn't expected to cause compatibility issues and it was non-trivial to add support for it, but we have it now.
Itoldmyselfso 7 hours ago [-]
You can change the link handling in the app settings so it doesn't try to open it via the app. Or open the site in incognito window.
Aachen 19 hours ago [-]
I wish it ran in Firefox on my pc...
thomasmarton 20 hours ago [-]
I tried it on my Pixel 10 Pro XL as well. Latest version of GrapheneOS, latest play store version of the app and it works.
Even tried completely nuking app data and logging in again. Login, security check, fingerprint setup, everything worked (I even got the alert that it used the Play Integrity API)
I assume if anything, this is probably the contactless payments.
I do somewhat understand why they are really trying to lock something like this down, but as everyone pointed out, giving the green light to a CVE infested version of Android while prohibiting the use of a version that goes above and beyond when it comes to security is absurd.
grapheneos 10 hours ago [-]
The issue turned out to be PayPal adding incorrect anti-tampering code incompatible with our secure app spawning feature.
onion2k 1 days ago [-]
Has PayPal blocked GrapheneOS, or have they blocked every OS they're unable to verify and done a poor job of implementing their checks?
The very fact they've managed to convince anyone that checking what OS I decide to run on the devices I own to check my own banking is any of their concern is a problem in and of itself.
grapheneos 10 hours ago [-]
PayPal accidentally broke support for GrapheneOS with the default settings for the app by adding incorrect anti-tampering code. It can be worked around using the per-app toggle to disable secure spawning. It shouldn't be necessary and we didn't expect there to be apps incompatible with secure spawning so we didn't originally design it to have a per-app toggle and had to add it.
Several of the more aggressive exploit protections are enabled for the base OS but are opt-in for user-installed apps. Memory tagging should work with all user installed apps but is opt-in because it's so good at detecting invalid memory accesses and uncovers a lot of bugs. Dynamic code loading via storage, dynamic code loading via memory and native debugging are allowed by default since a significant fraction of apps need those and it's not usually a bug. Users can set those as enabled by default for user installed apps which is particularly recommended for memory tagging but then people need to deal with the incompatibilities. The defaults don't cause issues with most apps so not everyone is aware of the per-app toggles.
y-curious 1 days ago [-]
Ironically, I had to apply Hanlon’s Razor to the impolite tone of your post
onion2k 1 days ago [-]
"Ironic" means saying the opposite of what you mean in order to be funny or sarcastic. So that would mean you think I was both polite and not an idiot.
Jokes on you though, I'm neither of those things.
23 hours ago [-]
4chandaily 1 days ago [-]
It is a useful tool, but is largely irrelevant to this issue.
To the end user, this isn't really much of a difference. Whether the cause is malice or simply not choosing to use the smallest effective brush, they are still taking an action that is preventing legitimate users from accessing the service.
redleader55 1 days ago [-]
You're a banking app. Why do you need to check my phone or my os? The security is not in what phone I use, but in how sane your 2-factor auth is and if even exists.
onion2k 1 days ago [-]
You're a banking app.
I've been called worse.
skinfaxi 1 days ago [-]
Hanlon's razor is for people. Organizations do not operate like people and do not deserve the same deference.
basilikum 1 days ago [-]
> have they blocked every OS they're unable to verify
This is evil in itself.
bossyTeacher 1 days ago [-]
They have blocked rooted phones based on the error provided. Nothing to do with verification. They treat rooted phones to a level they don't with phones without critical security updates. That's the tension. Non-rooted phones aren't necessarily unsafer.
fylo 1 days ago [-]
Graphene isn't rooted....
glitchc 23 hours ago [-]
We don't know if the OP has rooted their phone in addition to installing Graphene.
grapheneos 10 hours ago [-]
If they replaced the core of the OS with a rootkit, it wouldn't be GrapheneOS anymore but rather a derivative of it. They didn't do that and people should be clear if they have rather than calling it GrapheneOS.
prartichoke 1 days ago [-]
Confirmed on my phone too. I left a 1-star review on the play store saying it crashes on every launch, uninstalled and will use the website from now on. (Luckily, I dont use contactless payments, ai just send and receive money from friends from time to time)
grapheneos 10 hours ago [-]
You can solve it with the per-app toggle for disabling secure spawning. PayPal only accidentally broke compatibility with secure spawning. You should still complain to them about it.
bit1993 1 days ago [-]
I was always suspicious of GrapheneOS, thought it was too good to be true. But this makes me reconsider and want to install GrapheneOS.
grapheneos 10 hours ago [-]
Thankfully, PayPal hasn't banned GrapheneOS and their app still works on it. They accidentally broke compatibility with our secure app spawning feature which has a per-app toggle to disable it along with the other exploit protections which can cause compatibility issues.
There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.
nicman23 1 days ago [-]
it is great and you know that because cops are pissy about it
kissiel 1 days ago [-]
I think if paypal not working on GOS makes you not use it, then GOS is definitely not for you...
WCSTombs 1 days ago [-]
They're saying the opposite, no?
pirates 1 days ago [-]
They didn’t read it that closely, they just wanted to put someone down and move along.
kissiel 24 hours ago [-]
My parser got stuck on "Too good to be true, then reconsider."
bdzr 1 days ago [-]
I also ran into the eBay application being blocked just recently. Other than that I've had no issues, but I imagine this is going to become more and more common as time goes on.
microtonal 22 hours ago [-]
Most likely, unless the GrapheneOS user base can be grown quickly. We are at a point in time where the number of apps that block GrapheneOS through Play Integrity Strong is fairly small. So it's still possible to grow the user base since the inconvenience is not too large. Once the majority of banks would require passing Play Integrity Strong, far fewer people would switch.
So, best to grow the user base fast now and let every user send a complaint for every app that gets blocked. A few million users will be harder to ignore.
silisili 19 hours ago [-]
Motorola partnering is huge and should help this if it comes to fruition. They sell a -ton- of phones in the Americas. Best not to get on their bad side.
grapheneos 10 hours ago [-]
PayPal's app still works with the per-app secure spawning toggle disabling for it.
StrLght 1 days ago [-]
eBay has been enforcing Play Integrity for over a year now. Luckily you don't lose much by using it in a browser.
I also get why they'd be desperate to fight bots. It's a weak excuse for not doing it better, but at least it makes some sense.
anonymousiam 1 days ago [-]
Hopefully these stupid companies that are refusing to allow their apps to run on GrapheneOS will have a change of heart when Motorola begins launching their new phones:
PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.
master-lincoln 1 days ago [-]
if there is enough money to be made they will consider it...
glitchc 23 hours ago [-]
Have you explicitly enabled root access? GrapheneOS does not do so by default, in fact their documents explicitly mention that enabling root access weakens the OS's security posture. Many app protection frameworks detect root access and block by default.
savwolf 1 days ago [-]
This is what really makes me question if I want to continue to use GOS, already some UK banks apps (which are app only) don't want to run. I'm considering switching back to stock as I can't be bothered to try to find hacks and workarounds for daily necessities.
grapheneos 10 hours ago [-]
PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.
Have you tried the per-app exploit protection compatibility mode or the finer-grained toggles for those apps? 90% of banking apps work on GrapheneOS but MANY have problematic anti-tampering code requiring the per-app compatibility mode.
depressedpanda 1 days ago [-]
I would never use a bank that is app only. Sounds like a horrible experience.
microsoftedging 22 hours ago [-]
Same experience in the UK, but it was the push that got me to switch from Lloyds to Nationwide if you're looking for another option. They're great, they even have offline 2FA methods as they send you a card reader for things like authing purchases or sign-ins. And the app still works :-)
Flere-Imsaho 22 hours ago [-]
I use revolut on a stock pixel 9, have been considering Graphene, but im worried about stuff like:
Revolut still works for the vast majority of our users due to our workarounds for their attempted ban on it. We got in contact with Revolut due to our thread and they appear willing to avoid banning it going forward despite their past moves to do it.
AngryData 16 hours ago [-]
I still don't understand why people atill use paypal. It has veena shitty and shady company from the start and never got any better. They are known thieves that use political games to illegally seize money and get to keep it until you "prove" that $100 is yours and not used for random bs like "terrorism".
Eval-Apply 18 hours ago [-]
It might involve the Google Play Integrity API.
GrapheneOS officially passes only the MEETS_BASIC_INTEGRITY tier of the Google Play Integrity API and fails the MEETS_DEVICE_INTEGRITY and MEETS_STRONG_INTEGRITY levels.
Many banking apps I use in my country require this level plus something from the GPI API, which makes them unusable. You need a regular, unmodified smartphone to use them.
Itoldmyselfso 1 days ago [-]
The best approach to combat this is to cause as much headache as possible: bombard them with 1-star reviews, contact news sites, post this on social media sites snd contact Paypal's support.
grapheneos 10 hours ago [-]
It can be worked around with the per-app secure spawning toggle. Ideally people should still complain and get them to fix it.
microtonal 24 hours ago [-]
Good luck with 3.7M existing reviews.
Itoldmyselfso 22 hours ago [-]
With a user base of 500k if every GOS user left a review that'd make a dent.
microtonal 22 hours ago [-]
True. But when the Volkswagen block was publicized a lot, last time I checked the number of stars didn't even decrease by 0.1 (even though there were a bunch of negative reviews). Admittedly, PayPal probably has more GrapheneOS users than VW, but with VW negative reviews could have made a serious dent.
onaclov2000 1 days ago [-]
Dumb idea, but I wonder if the underlying os can see who is asking questions like do you have root, And if an app has no need to know, it just plays dumb and responds...of course not. It's a bit of a chicken and egg problem, in that if you don't know what apps need to know if you have root, or not, then you can't determine that at the OS level...maybe an option for the user (popup) to tell the program, tell them we are rooted or not? (Or a settings page you can determine what apps can know root or not)
Retr0id 1 days ago [-]
That's exactly how modern Android rooting tools work. You select which apps you want to have root, in a manager app. No other app should be able to notice.
But GrapheneOS isn't root, that's just PayPal's thing being broken.
grapheneos 10 hours ago [-]
GrapheneOS isn't rooted. The issue is their flawed anti-tampering code shipped a new bug breaking compatibility with secure spawning. We have a per-app toggle for secure spawning due to seeing this with other banking/financial/government apps and it works for PayPal's app as the original poster discovered.
If they want to ban arbitrary operating systems, they can use attestation and it can't be fooled the way you're describing. Apps doing this can explicitly verify GrapheneOS and we've convinced some apps to do that. We've also convinced a smaller number to stop doing that at all.
NoidFonsense 1 days ago [-]
perhaps but this is about device/os attestation, not rooting
kevin_thibedeau 1 days ago [-]
How does their web site do device attestation? The argument that apps have to be locked behind a validation mechanism controlled by Google to be secure is BS when a cookie is sufficient.
steveharman 23 hours ago [-]
Isn't this more about PayPal disliking a rooted device rather than Graphene? I used to have all kinds of issues with financial apps when I was rooted, regardless of OS
edoceo 23 hours ago [-]
It's been explained in this thread many times: not-rooted
grapheneos 10 hours ago [-]
GrapheneOS isn't rooted. The issue is their flawed anti-tampering code shipped a new bug breaking compatibility with secure spawning. We have a per-app toggle for secure spawning due to seeing this with other banking/financial/government apps and it works for PayPal's app as the original poster discovered.
Groxx 23 hours ago [-]
Flawed root detection issues are kinda common to see when running Graphene, tbh I suspect this is just an accident - it very much is not the first time, nor the first for PayPal.
goonersallofyou 1 days ago [-]
I remember when I had to boot up an old windows machine because TurboTax refused to run on a Linux (might have been something related to flash as well... been too long to recall), then I just ran Windows in a VM, then extensions allowed me to do User-Agent spoofing (honestly should have thought of this sooner), and now they don't seem to care at all. I did my taxes on OpenBSD last year.
Grisu_FTP 1 days ago [-]
I still remember when my bank wanted me to run Android 9 instead of my Android 15 rom (without root) on my Samsung S8 because "muh security!!"
Funnily enough, the only way to hide those detections was to Root my phone...
And i still remember when i had an appointment there, they wanted to see something in my Bank app, i opened it (and i assume it had an update since i then last used it) and a big "THIS DEVICE IS NOT SUPPORTED. ROOT IS NOT SUPPORTED" poped up
But was as simple as readding the bank app to my root hiders.
but still, i hate this security theater
schnittbrot 1 days ago [-]
I've been using it in the browser with GOS no problem.
Any reason why one would need the app besides a little more convenience?
aframemodular 1 days ago [-]
They require the app for certain things like managing which PayPal debit card category gets 5% cash back
grapheneos 10 hours ago [-]
The app can still be used too but requires the per-app secure spawning toggle with recent app versions. It's due to PayPal shipping buggy anti-tampering code.
Helmut10001 1 days ago [-]
Why do you need PayPal APP? I have grapheneos and just tested logging in to PayPal web. Works.
grapheneos 10 hours ago [-]
Some features are app specific such as tap-to-pay, which does work on GrapheneOS. PayPal's app still works with the per-app secure spawning toggle disabled. It's a bug in their recent updates causing an incompatibility with secure spawning and they should fix it.
josephcsible 1 days ago [-]
This wouldn't be that bad if they had a functional website you could use instead, but their website doesn't even let you do things like pick your monthly rewards category or configure auto-replenish for your debit card.
grapheneos 10 hours ago [-]
PayPal's app still works with the per-app secure spawning toggle disabled. It's a bug in their recent updates causing an incompatibility with secure spawning and they should fix it.
Tap-to-pay is unlikely to be provided via their website and does work on GrapheneOS.
jordand 1 days ago [-]
I've disabled auto-update for PayPal in the Play Store and also Disabled the app locally (so I can re-enable when rarely needed). They'll force people to update soon enough given how banking apps are.
grapheneos 10 hours ago [-]
The latest updates still work on GrapheneOS with the per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.
dennemark 1 days ago [-]
Looking at the description, the title should be changed to "Contactless PayPal card does not run on GrapheneOS"
I use latest Aurora Store PayPal version and it still works. I just dont use contactless payment.
hashworks 1 days ago [-]
I'm not using the contactless payment feature and get the same crash and error.
grapheneos 10 hours ago [-]
The app can still be used too but requires the per-app secure spawning toggle with recent app versions. It's due to PayPal shipping buggy anti-tampering code.
grapheneos 10 hours ago [-]
It's not specific to contactless payments. It's a bug in the app and still works with the per-app spawning toggle disabled. The per-app exploit protection compatibility mode sets all these toggles to the compatibility mode but it's best to figure out the minimum required.
Kwpolska 1 days ago [-]
Why would anyone still use PayPal after so many cases of accounts being banned and funds being frozen for no reason, and all the other terrible stuff they've done?
dewey 1 days ago [-]
Easy to say when you are in a country where you have a lot of options.
There's some countries with very bad financial sector where your option is PayPal or Western Union as the local banks don't know how to do international transfers, Remitly doesn't support all countries and Wise also doesn't work. PayPal works, even if they charge fees.
cloudie78 1 days ago [-]
Which countries have local banks that don’t know how to do international transfers?
dewey 1 days ago [-]
We were having a lot of problems with that in Honduras, staff in the branch did not know how to do that, fees are extremely high and sometimes the bank system is just offline and you get sent home. There's a reason all these alternatives like Western Union etc. exist for this remittance use case.
It was a big reality check for me usually living in Germany and having access to a lot of banks and modern neo-banks.
kalleboo 1 days ago [-]
My local banks know how to international transfers but I have to go into a bank office and fill out a paper form. Receiving international transfers they call and ask if I wish to accept it, if I can't answer the phone right then the transfer gets delayed. If the sender does not include my middle name, I have to come into the office and sign an affidavit that this person with this different name is also me. Each time.
cloudie78 1 days ago [-]
Thank you for sharing your experience. I don’t know what your local banks are and what country you’re talking about.
24 hours ago [-]
dumberquestions 20 hours ago [-]
As a freelancer, clients often simply refuse to use anything other than PayPal, I've faced that scenario dozens of times.
FireBeyond 23 hours ago [-]
Oftentimes it's not necessarily that they don't know, but unless two international banks have a direct relationship, they have to use intermediary banks. Even my parent's large bank in Australia, when wiring me a gift towards my home purchase, had to go via an intermediary bank who could then forward-on to my bank.
rciorba 1 days ago [-]
Critical mass? I had to start using it after moving to Germany, because everyone else expects you to use it.
One of the ladies at daycare is leaving? Here's a paypal link to chip in for a good-bye present.
Split a take-out order with a German friend, but he paid? Here's his paypal to send him your share.
It's just assumed that everyone has paypal over here...
OroPla 1 days ago [-]
As a German that never has encountered PayPal in the wild and doesn't have a Paypal account either, your narration requires elaboration to be believable.
dewey 22 hours ago [-]
I'm not doubting you but I have a hard time believing that, as I see it all the time. Sometimes restaurants even accept it if they don't take card and then ask you to send to their private PayPal account as a fallback. It's even part of many German memes around the German way of always splitting the bills, even if it's just < 5 euros.
OroPla 21 hours ago [-]
What you are describing sounds like a weird alternative reality. I never heard of always splitting bills, either. But it's not exactly a homogeneous country. To the point everyone jokes that Bavaria isn't even German, for example.
Depending on which state you are in, your experience can be vastly different.
All the states used to be kinda independent two hundred years ago. Including having different currencies. Unification happened 1871. Bismarck and later Hitler kinda brought the nation together, but after losing two world wars national pride got frowned upon and having the iron curtain cut through the country didn't help in fostering a German identity, either. Reunification was only 36 years ago. Though, about a third to maybe half of the German territory remains lost after losing the wars. Instead we got the EU. The more things change, the more they stay the same.
It's always funny to see foreigners make fun of German supposed clichés that I never had any exposure to whatsoever, like Lederhosen, which is only a thing in Southern Germany.
iammrpayments 1 days ago [-]
Thought they use Sepa
mr_mitm 1 days ago [-]
I wish. The small inconvenience of putting in an IBAN and a matching name instead of just an email address is already enough for many people to default to paypal. Just happened to me again yesterday, the guy preferred to bring cash next time we see each other instead of just receiving my info via text.
carlosjobim 23 hours ago [-]
"The guy" probably let you know in a polite way that you were behaving immaturely. You're not supposed to ask your friends for money to split bills etc. The way grown ups do it is "I pay this time, you pay next time".
mr_mitm 23 hours ago [-]
No, he didn't. He offered to cover a case of beer for after our game at the park, but he didn't have a car, so he asked me to bring it and he'll pay for it. Afterwards he came to me (I never brought up the topic of money) and asked for my Paypal details. How am I in the wrong here?
The whole "I pay this time you pay next time" is already covered by "everybody brings a case once in a while", but if the guys without cars just ask someone else to pay for it when it's their turn it won't add up.
If you're going to make assumptions, perhaps start with those that don't paint me in a bad light.
carlosjobim 22 hours ago [-]
You weren't in the wrong, he was. He shouldn't have asked somebody to pay for something and bring it if he didn't have the money at hand to cover for it. PayPal isn't real money in this case.
If this was a long time friend, I'd let it slide. It's just a case of beer, and in Germany beer is dirt cheap. If this was a new acquaintance, I'd let it slide and take note that it's not a person to make friends with.
> If you're going to make assumptions, perhaps start with those that don't paint me in a bad light.
Good point. But all of this isn't a problem of payment systems, but of people's behaviour.
socksy 23 hours ago [-]
This is not how German culture works.
drabbiticus 23 hours ago [-]
This seems likely to be cultural, possibly even microcultural.
I know many adults who believe that splitting bills is a normal and reasonable thing to do.
carlosjobim 22 hours ago [-]
Splitting bills, where each pay a part in the restaurant, fine. Splitting bills where one pays and the other sends him money, not.
drabbiticus 21 hours ago [-]
Who is making these rules up? Why do you think they apply universally?
carlosjobim 2 hours ago [-]
God made them, as far as I know. Humanity lived in gift economies long before the invention of barter and trade.
These are etiquette rules, which have their benefits. Since nobody is forced to follow etiquette, they help you to learn things about people.
Generosity is one of the easiest life hacks to find out who is friendly towards you and who is not. If you buy them a drink and they won't buy you a drink back, that's a tiny cost for you to know what kind of fellow you're dealing with. If they buy you a drink and then asks you to transfer money to them, you also learn something about them. If people splitting bills want to sit and count to make sure that everybody pays exactly for what they had, then you learn something. And so on.
If you invite people for dinner a few times, you will learn something about that person whether you wanted to or not.
drabbiticus 59 minutes ago [-]
The presence of social constructs is advantageous to group survival, and an individual operating within a given set of such constructs may choose to adhere to or reject the norms of those constructs. As you say, you do learn things about people through interacting with them. I think ideally this interaction includes discovering what their norms are, whether they believe they are conforming/rejecting/otherwise to a status quo, and the reason for it. The action itself is may not be sufficient to infer an individual's values without the context and reasoning, especially in the absence of clear communication. Social constructs are local to social groups and subgroups, with differing levels of conservation and generalization between groups.
netsharc 1 days ago [-]
SEPA uses your IBAN (account number), and one can also enter this account number for payment, implicitly allowing the store to withdraw money from it...
c7b 1 days ago [-]
You must be referring to SEPA Direct Debit, which would be very risky to use to siphon funds. There's an 8 week no-questions-asked refund policy, 13 months for unauthorized transactions, if the payment fails (eg due to insufficient balance), the payee is charged a non-refundable cancelation fee. [0] And that's all separate from any legal troubles for fraudulent charges. I don't know why Germans use PayPal over SEPA, but I'd be surprised if SEPA Direct Debit was the reason.
IBANs aren't secret, they have the same level of confidentiality as your address or birth date.
One-off SEPA Direct Debit is virtually unheard of, recurring payments are a bit more common but usually involve a €0,01 payment to prove ownership of the account. The transactions are also trivial to undo, and can only be initiated by companies.
So no, "IBAN fraud" isn't a thing in practice. You can safely share your IBAN with your friends for instant free wire transfers.
fuzzy2 1 days ago [-]
Well yes. But just in case this wasn't clear: this is a crime, and you will get your money back in most cases. It's on the merchant to ensure a Direct Debit Mandate is actually valid.
master-lincoln 1 days ago [-]
I do not think it is possible to withdraw money having only an IBAN.
It would need a SEPA direct debit mandate for my bank to accept the transfer request.
skinfaxi 1 days ago [-]
That sounds like the same info on a check, which people hand out freely. I'm probably misunderstanding.
rciorba 1 days ago [-]
Sepa is how my kid's daycare debits me each month, or how I transfer money to other accounts (most bills are direct-debit, but sometimes I get a one-off invoice and I have to transfer the money myself).
But for the small person-to-person type thing, paypal is the defacto here (sadly).
cloudie78 1 days ago [-]
Time to start heralding change you want to see. Offer Wero instead. It’s really simple.
drdexebtjl 22 hours ago [-]
“I don’t use paypal, here’s cash”
DemetriousJones 1 days ago [-]
I simply use it as an intermediary between my bank and any website I don't fully trust
fg137 1 days ago [-]
I use "virtual card" for those needs. For me, it doesn't justify bringing out PayPal
dylan604 1 days ago [-]
I've had to use it when my bank's purchase limits did not allow for card (virtual or real), but the same purchase was allowed when going through PayPal. It was annoying AF, but was much faster than contacting my bank and getting permission to spend my money.
iamnothere 1 days ago [-]
Privacy.com is a better option, but some merchants block it.
k4rli 22 hours ago [-]
So both Paypal and Visa/Mastercard get a cut of every transaction. At least with a regular virtual card Paypal isn't getting their cut. Having Paypal as a middleman will make chargeback requests harder as well since they likely need to be negotiated with before the actual card issuing bank.
qingcharles 23 hours ago [-]
For the unbanked, PayPal is like Chime and Cash App. A quick way to be able to deposit incomings and get a debit card where you can spend them.
1 days ago [-]
vlyan 1 days ago [-]
because global-ish exchange of goods and services for money is a deliberately convoluted experience that only a handful of well-connected entities are allowed to facilitate, which enables each and every one of them to put "we reserve the right to fuck you in the ass for any or no reason" in their ToS.
zache6 1 days ago [-]
It works for me after enabling exploit protection compatibility mode. Pixel 9a on latest versions of GOS and PayPal.
grapheneos 10 hours ago [-]
With the default settings, the latest versions of PayPal only require disabling secure app spawning.
It may also require dynamic code loading via storage, dynamic code loading via memory and native debugging being permitted but those aren't blocked for user installed apps by default. People can opt-in to those being enabled by default for user installed apps similarly to memory tagging, but memory tagging has the biggest positive impact.
1 days ago [-]
taegee 1 days ago [-]
Still works fine for me. PayPal and GrapheneOS are both on the current release.
grapheneos 10 hours ago [-]
PayPal's app requires disabling the per-app secure spawning toggle for it now due to buggy anti-tampering code. You may have already enabled the per-app compatibility mode which includes that.
You may also not have the update yet. Play Store supports staged rollouts where updates are only available to a set percentage of users.
tombardier 1 days ago [-]
Still works on my up to date pixel 9 xl. I haven't enabled NFC payments though
grapheneos 10 hours ago [-]
Their recent updates require disabling secure spawning via the per-app toggle, that's all. NFC payments still work.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
chmod775 22 hours ago [-]
Works just fine for me on an unrooted Pixel 10 Pro.
grapheneos 10 hours ago [-]
PayPal's app requires disabling the per-app secure spawning toggle for it now due to buggy anti-tampering code. You may have already enabled the per-app compatibility mode which includes that.
You may also not have the update yet. Play Store supports staged rollouts where updates are only available to a set percentage of users.
cactusbee 22 hours ago [-]
Ah, that is why it was crashing on my device :(
grapheneos 10 hours ago [-]
PayPal's app requires disabling the per-app secure spawning toggle for it now due to buggy anti-tampering code.
https443 1 days ago [-]
Similarly, Cash App does not work on Graphene
bookofjoe 1 days ago [-]
I would bet that fewer than 1/1,000 non-HN users have ANY clue what it means to root a device. I sure don't!
grapheneos 11 hours ago [-]
GrapheneOS doesn't involve rooting a device. It's a privacy and security focused OS for hardware with official support for using another OS.
bookofjoe 2 hours ago [-]
Alas, GrapheneOS doesn't work with iPhone.
ethagnawl 1 days ago [-]
Does the website still work?
grapheneos 11 hours ago [-]
Yes, but PayPal's app still works on GrapheneOS too.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
varispeed 1 days ago [-]
This should be illegal, but it won't. Corrupt politicians want people to be only on the approved operating systems so they can be surveilled.
grapheneos 10 hours ago [-]
It does still work. It's just a bug in their anti-tampering code breaking it with secure spawning. Using the per-app secure spawning toggle or broader per-app exploit protection compatibility mode resolves it. PayPal should fix their code.
1 days ago [-]
hkt 22 hours ago [-]
This happened to me with Starling Bank's app years ago. I have since conceded defeat. What is pernicious is how some of these services are unusable without an app, while also bossing the user around about what operating system they can use. Starling left me without any access to any of my bank accounts at the time (2022 or so) so now I use very old school online banking now to avoid this situation ever occurring again.
grapheneos 11 hours ago [-]
PayPal still works on GrapheneOS.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
Starling Bank app still works on GrapheneOS too. See here:
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
kova12 1 days ago [-]
How is it that PayPal is still relevant? What does it even offer these days that other platforms don't do better?
grapheneos 10 hours ago [-]
PayPal and Curve Pay support tap-to-pay on GrapheneOS in Europe where they have it deployed. Google Pay bans using GrapheneOS for it via the Play Integrity API. Most banks only support using Google Pay rather than having an alternative in their apps. Many European banks have an alternative.
PayPal's app does still work on GrapheneOS, they only accidentally broke it with the default settings due to bugs in their anti-tampering code. Disabling the per-app exploit protection compatibility mode works around it. They should fix it and start testing on GrapheneOS.
doublerabbit 1 days ago [-]
When threat comes knocking, the door gets bolted-shut.
1 days ago [-]
gib444 1 days ago [-]
With or without Google Play Services running?
leumon 1 days ago [-]
With. But disabling "Secure app spawning" seems to fix it for now.
gib444 21 hours ago [-]
Ew that's a nasty workaround. But interesting to know!
grapheneos 11 hours ago [-]
Secure app spawning is a per-app toggle now so it doesn't reduce OS security or the security of other apps without it disabled. It only reduces security of the app with it set to disabled. If multiple apps have it disabled, they share the same ASLR bases, memory tags for memory allocated before fork and other things.
It's one of the toggles changed by the per-app exploit protection compatibility mode. If an app doesn't work, that's the first thing to try. It can then be narrowed down to a specific setting.
The more aggressive exploit protections uncovering a lot of compatibility issues are only enabled for the base OS and specific user installed apps by default. Those can be set to enabled by default for all user installed apps and then people have to deal with the per-app toggles a lot more. This applies to memory tagging, disallowing dynamic code loading via memory/storage and disallowing native debugging (ptrace).
gib444 8 hours ago [-]
Thanks Daniel. Nice to see you back again tirelessly educating the community about GrapheneOS, almost no comment not replied to!
grapheneos 11 hours ago [-]
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
1970-01-01 1 days ago [-]
Funny how PayPal don't trust you to safely handle root but they will trust you to pay thousands in loans, credit, etc. What a joke.
grapheneos 11 hours ago [-]
PayPal still works on GrapheneOS.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
1 days ago [-]
paperscissors 1 days ago [-]
[flagged]
fenestella 1 days ago [-]
[dead]
justmarc 24 hours ago [-]
[dead]
hoshi73 1 days ago [-]
Did you try enabling the exploit protection compatibility mode in the app settings? GrapheneOS should have shown you a Play Integrity API detection notification if the app is actively trying to block non-GMS-certified devices using Play Integrity API.
grapheneos 11 hours ago [-]
This is a correct answer despite the fact that it was previously hidden by flagging. PayPal's recent updates with incorrect anti-tampering code work fine on GrapheneOS when secure app spawning is disabled. It's best to disable only secure app spawning (exec-based spawning) for it instead of using the whole compatibility mode. Using the whole compatibility mode is the first thing to check before narrowing it down though.
ButlerianJihad 11 hours ago [-]
So the OP is just lying out of ignorance and rash judgement, and spreading calumny about PayPal. And PayPal has done nothing to their app to block GrapheneOS. And hundreds, thousands of participants on HN have been misled by another rogue "Tell HN". Good times.
grapheneos 11 hours ago [-]
They're not lying but rather likely didn't know about the per-app exploit protection compatibility mode. They narrowed it down to secure app spawning needing to be disabled. Now they know what to do when an app doesn't work on GrapheneOS.
You can help by upvoting the update they posted with the solution:
They did actually and knowingly lie. Because I guarantee that they had no way to affirmatively know that PayPal themselves had done anything to their code. They didn't see no ChangeLog and they didn't see no Release Notes about it. They didn't read any news from the app developers. They jumped to conclusions about malice when it was actually incompetence and ignorance, much like their own.
They could've simply neutrally stated that: "PayPal crashes when I try and run it under GrapheneOS" and that would be a true statement without assigning blame or malice. But, not knowing PayPal was innocence, they chose to assign malice to them instead. That's a choice. That is rash judgement and calumny.
nekusar 22 hours ago [-]
[flagged]
helloiamantoine 1 days ago [-]
[flagged]
dingdong2026 1 days ago [-]
[flagged]
deepc4life 16 hours ago [-]
[flagged]
grapheneos 10 hours ago [-]
It doesn't defeat the purpose of GrapheneOS. GrapheneOS does not require people to do all their financial transactions with Monero to heavily benefit from it.
Their app can also still be used on GrapheneOS. It just requires the per-app secure spawning toggle due to a recently added app bug.
freakynit 1 days ago [-]
[flagged]
grapheneos 11 hours ago [-]
GrapheneOS isn't rooted. PayPal works on GrapheneOS and doesn't try to ban using it. However, they recently shipped incorrect anti-tampering code incompatible with our secure app spawning feature (exec-based app process spawning). It can be worked around by disabling the per-app secure spawning toggle for PayPal. For simplicity, there's a per-app exploit protection compatibility mode toggle which sets all the finer grained exploit protection toggles to the compatibility mode.
GrapheneOS is an operating system rather than read-only memory firmware. There's a ROM in early boot (boot ROM) which loads the SoC boot firmware from the SSD which loads other SoC firmware from the SSD and then loads the OS from the SSD.
leumon 1 days ago [-]
Well I haven't rooted my device. It's just normal grapheneos
freakynit 1 days ago [-]
[dead]
therealmarv 1 days ago [-]
[flagged]
grapheneos 11 hours ago [-]
GrapheneOS isn't rooted. PayPal works on GrapheneOS and doesn't try to ban using it. However, they recently shipped incorrect anti-tampering code incompatible with our secure app spawning feature (exec-based app process spawning). It can be worked around by disabling the per-app secure spawning toggle for PayPal. For simplicity, there's a per-app exploit protection compatibility mode toggle which sets all the finer grained exploit protection toggles to the compatibility mode.
tensegrist 1 days ago [-]
iirc grapheneos can't be rooted unless you do your own build
grapheneos 11 hours ago [-]
There's only root if people make a userdebug build with user-accessible root or make a derivative of GrapheneOS with major modifications. The production builds don't have uncontained root since it would greatly roll back the security model. Only a few core processes run as a limited subset of root.
futune 1 days ago [-]
That's the bizarre thing about this hn discussion... A lot of people referencing rooted phones, but to the best of my knowledge GrapheneOS is almost never rooted?
grapheneos 11 hours ago [-]
There's only root if people make a userdebug build with user-accessible root or make a derivative of GrapheneOS with major modifications. The production builds don't have uncontained root since it would greatly roll back the security model. Only a few core processes run as a limited subset of root.
Sophira 1 days ago [-]
[flagged]
grapheneos 11 hours ago [-]
Replacing a large portion of the core operating system code and SELinux policies with a third party project is making a derivative of the OS. It can no longer receive standard updates anymore and won't pass verified boot without resigning it. A derivative of GrapheneOS with significantly different code, SELinux policies and distinct signing keys is not GrapheneOS. Verified boot will no longer work as intended anymore even after resigning and the same applies to a large portion of the security model in the OS. Giving root to a huge portion of the OS greatly reduces security even if it's never granted to any apps.
windowliker 1 days ago [-]
Isn't it more likely to be saying that the app is running with root privileges?
1 days ago [-]
12ahs71 1 days ago [-]
[flagged]
grapheneos 11 hours ago [-]
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
BoredSmurf 22 hours ago [-]
[flagged]
grapheneos 11 hours ago [-]
Android remains open source via the Android Open Source Project.
The vast majority of Android apps including PayPal work fine on GrapheneOS.
PayPal recently shipped incorrect anti-tampering code incompatible with our secure spawning feature. The feature spawns app processes with exec to provide their own address space layout randomization, random memory tags and canaries. We're aware of these kinds of incompatibilities and provide a per-app toggle for exec-based spawning which works for PayPal. PayPal made a mistake and didn't consider GrapheneOS as part of this recent change. They'll likely fix it since they don't ban using GrapheneOS and likely want it working on GrapheneOS.
romanovcode 22 hours ago [-]
[flagged]
jadar 1 days ago [-]
[flagged]
grapheneos 10 hours ago [-]
GrapheneOS isn't rooted. It's caused by their anti-tampering code being buggy and recent releases of the app wrongly detecting secure spawning as tampering. We have a per-app secure spawning toggle due to these issues and that works around it.
daveoc64 1 days ago [-]
GrapheneOS doesn't give you root access.
The OS is designed to offer privacy and security guarantees, which root access breaks, so they don't offer it.
Aachen 19 hours ago [-]
Having access to your own device doesn't break anything, they just don't want to be put in the same category as other FOSS Android distributions and play by Google's book so that apps will at least allow one open OS to work
ledoge 1 days ago [-]
A normal GrapheneOS installation uses Android Verified Boot with a locked bootloader, and does not give the user root access. Google's Play Integrity cannot be used to verify the integrity of the OS (as GrapheneOS is not approved by Google), but equivalent verification can be done using standard Android APIs and GrapheneOS's public keys.
p0w3n3d 21 hours ago [-]
I wonder do you have administrator access on your Windows/Mac/Linux?
Because your argument sounds like you gave the admin password to someone else to prevent yourself from tampering with your computer for the security reasons
nunobrito 1 days ago [-]
[flagged]
grapheneos 11 hours ago [-]
PayPal works well on GrapheneOS. PayPal shipped incorrect anti-tampering code wrongly detecting our secure spawning feature as tampering. It works fine when the per-app toggle for secure spawning is disabled. These incompatibilities with hardening features are relatively common in banking apps. We provide an overall exploit protection compatibility mode toggle for ease of use rather than people needing to figure out which feature is incompatible.
GrapheneOS has never received or applied for any government grants. It doesn't have any involvement with any governments. GrapheneOS is banned by the Play Integrity API device and strong integrity levels. In practice, the only app compatibility issues which can't be worked around with our compatibility issues are apps adopting the Play Integrity API to enforce those.
imska 1 days ago [-]
It does work for me on lineages for microg with an Xperia 5 II.
Haven't tried to activate contactless though.
grapheneos 11 hours ago [-]
PayPal works fine on GrapheneOS too. They recently shipped an update with incorrect anti-tampering code incompatible with our secure spawning feature. It can be worked around by toggling off secure spawning as the creator of this thread figured out on their own. For ease of use, we have a simple per-app exploit protection compatibility mode setting all these features to a compatibility mode instead of people needing to figure it out.
nunobrito 1 days ago [-]
[flagged]
iqra_c 19 hours ago [-]
[flagged]
grapheneos 11 hours ago [-]
PayPal doesn't ban GrapheneOS. They accidentally broke compatibility with secure app spawning (exec-based app process spawning). It can be worked around by disabling secure spawning for the app. That's done automatically by the simple per-app exploit protection compatibility mode which sets all of these exploit protection toggles to the compatibility mode.
Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good guy or a bad guy so it's easier to just ban guns.
Edit to clarify: I don't say I agree with that, I believe that if they don't want you messing around inside their app, then they shouldn't ask to be on your device.
It's normal to have root (or Administrator) on your devices. After all, they are yours. They don't belong to the device manufacturer. You should have full access to your own devices by default.
Only recently did we somehow normalize the idea that the user should not be the ultimate decider over their own devices.
I assume the issue is it failing the deeper play integrity check which is about it not being "Google approved."
User accessible root access is available in userdebug (non-production) builds. There's no system for granting root access to apps. It's no different from the stock OS in this regard, but it's a lot more secure than the stock OS.
I propose you buy enough ingredients from the supermarket and make a big batch.
The scientific test is: how far do you get, before your door is kicked in?
If that fails, then science #2: have fun lighting it!!
You almost win both ways. (although I admit I wouldn't fund you even via a trustworthy intermediary say a Kickstarter campaign.
On a side note, if you want to be extremely specific, the line between the physical and digital threat does not exist anymore. There are two things people need to be afraid of: incompetent friends and competent enemies. Tech giants are already filled to the brim with incompetent friends, which drastically lowers the bar for the competence of their enemies.
Thankfully, PayPal hasn't banned GrapheneOS and their app still works on it. They accidentally broke compatibility with our secure app spawning feature which has a per-app toggle to disable it along with the other exploit protections which can cause compatibility issues.
There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.
It's similar to how people don't like sites blocking entire countries or access from Tor, etc. You might be doing it for privacy...but all the people trying to commit fraud are also using those same channels to hide their identity. The blockades are one piece of a holistic security picture that frustrate the well intentioned users.
As for geo fencing or blocking Tor... HAH! As if that's ever stopped anyone with the will. That is the last concern of anyone with a malicious intent. Sure, it stops irritating kids but no one beyond that.
The simple fact is that cybersecurity was in an abysmal state before the slopification began and it's infinitely worse now. Paypal is no different given that much of their support has been outsourced to slop machines. Punishing the users that know what they are doing while rewarding the ones that don't is the most counter-productive and detrimental crap anyone could come up with.
It's not about user security.
From what we see above it sounds like the change trips their rootkit detection, which they are probably interpreting as a compromised device.
It sounds like you're expecting them to have a perfect security posture that can correctly identify fraud in call cases and only block the real thing. It's more complicated than that and there's typically some type of scoring system involved with numerous triggers that are higher value indicators of potential fraud. If they think the device is compromised, that's probably a high value indicator.
This is just me speculating.
No. It's the offensive fraud vector coming from unsecured devices that account for a significant portion of the noise. Requiring device profiling aggravates this vector.
Bullshit! Source:
> The reality is that European laws are much harsher when it comes to payments and personal data protection and the security team I was being interviewed for was catastrophic
Sounds like someone who wanted to impress the audience with fluffed up claims.
Just because you argue with vigor and intent, it doesn't make you right.
People are offering their opinions, try not being a dick about it.
GrapheneOS is a privacy orientated OS which is great. But if the vectors to achieve privacy are the same as used by bad actors, I'd block it too.
Get over it, don't like it? Use a different product. Or make a better one.
A more apt analogy might be game developers who demand admin rights so they can install a rootkit to detect "cheating".
Similarly, payment processors lose their appeal if they can't prevent people stealing your money, or spending stolen money on your products.
The needs of the user don't matter to them at all.
They have all the data they need, and they choose not to use it.
I think that's a limitation of the analogy because there is no correspondence with trusted computing. I guess it would be some sort of a magical gun that some other company is endorsing as of limited use during bank robberies? Maybe like some sort of RFID thing that disables the gun when inside a bank?
Anyway it really stretches the analogy to get tied up in technical details (risks missing the forest for the trees type error).
Also I highly doubt that there is any real statistics anywhere about whether this is a real threat or not. I guarantee that nobody did such statistics properly. The only known data is from companies which sell root prevention tools, so totally unreliable. And internally I guarantee, that no banks collect such info.
So no, banks lie about this only because they can sell this to judges as safety feature, when they fuck up, which happens continuously.
If you have a nominally unrooted phone on an old Android version and download malware, it can exploit a kernel bug and give itself root access and do whatever it wants.
Protecting against the first case and not the second is at best security theater.
They allow you to open PayPal.com on any web browser. Running Windows/macOS/Linux is basically identical to a rooted Android phone (you have local admin rights, you can modify and automate the browser, and can run unsigned code).
Apparently the world can't adult and be responsible for their actions, or people believe in that.
and if GrapheneOS was a root-having OS.
From a Paypal security POV, weather you use "custom Android OS" or an hugely outdated Android phone, you have:
- a similar risk for the "you" want to mess with Paypal case, in both cases the "you" can technically most likely mess with anything including the "virtual secure module" thingy android uses for NFC
- a lower risk for "others" wanting to mess with Paypal through your phone, at least if "custom Android OS" is GrapheneOS or another up-to-date android fork with decent security handling
so as far as I can tell, this inconsistency is very clearly not about PayPal's security.
IMHO it's about two other things:
1. marketing, if PayPal doesn't work on Android they lose customers, GrapheneOS for now has a tool small customer base for them to care. Outdated Android phone do have a large customer base.
2. compliance/politics BS. including potentially involving insurance. Compliance is mostly about checking of tickmarks(1) on outdated Android they can check them off and blame the user, Goodle or "hackers" for the issue. On GraphemeOS they have a harder time checking it of. Add the smaller user base and end up with PayPal doesn't care. Also iff things go wrong with Paypal on GraphemeOS in a public manner you will have all the "crime os" bad news bs, you won't have that if things go wrong with a even more risky highly outdated Android phone.
-----------------------
I got a bit to much off topic below:
(^1): Technically compliance should be about building robust, secure, law compliant systems and "showing" that by being able to pass a compliance tests consisting about a bunch of requirements. Practically there is way to many ways you can be "fully compliant" (on paper) but not secure and "very secure" but not compliant (wrt. security regulations). In the former case this might still come back and bite you iff you get sued or people suing which should get right don't get it because of ad-absurbum reasoning like "they comply with security regulations, hence can't have acted negligent". It's a shit show I don't know how to fix even if I could just magically change laws as compliance rules need technological flexibility, but if you give them that that will be abused to make insecure things pass. And the whole industry around checking that isn't really one who cares about actual security, sometimes outright corrupt (like groups which have the necessary accredited to check your compliance, are strangely more expensive then other groups, and somehow find less issues in average, with some excuse of why that isn't strange ...) :/
---
Lastly similar to how Teams or Slack could easily support FF (^2) but not only don't but outright refuse to try to even work. PayPal likes to act similar and doesn't care about niches. E.g. at least on some Mobile browsers WebAuthn works, but the PayPal website refuses to _even try_ 2FA with WebAuthn on mobile no matter if the APIs are there or not.
(^2): Yes there are some challenges, AFIK especially in certain edge cases most user might never run into. But Jitsi made it work, other smaller apps also made it work. And Jitsi is open source, so they technically can "look up" all the tricks to make it work (algorithmic ticks, not copy-pasting code) or outright just use their system with an appropriate contract (probably would be even cheaper wrt. maintenance cost then building your own system). At Slack/MS Teams scale that behavior is just messed up.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
The first thing to try when an app doesn't work is trying the per-app exploit protection compatibility mode. That sets all the per-app exploit protection toggles to the compatibility mode. If that works which is likely the problem, it can be narrowed down.
Nearly all Android apps are compatible with GrapheneOS. The exception are around 10% of banking and government apps which use the Play Integrity API to ban using a non-Google-approved device or OS. That's visible to users on GrapheneOS via a Play Integrity API usage notification. After the first use by an app, GrapheneOS provides a menu for blocking using the Play Integrity API which sometimes gets apps working because many don't enforce it working. It's not fully reliable and can have downtime so apps often don't enforce providing a result.
"OS that user compiled herself" can avoid this nonsense
No "smallcorp" is safe from Silicon Valley "largecorp" for long with the amounts of money SV largecorp can, and will, offer smallcorp if smallcorp grows. SillyCon Valley "largecorp" wants data about/from users, not users' money
"Safe way to make sure I'll stop being your customer - also YES!"
The user is not SV largecorp's customer
I don't think they care at all about the size of graphene os market share
if its jeopardize entire userbase then its not worth it
A financial security audit is one of the most thorough security audits you can ask for in software.
GrapheneOS gets blocked because it doesn’t follow the secure system requirements (root).
>(root)
GrapheneOS is not rooted.
They do their damndest to prevent owners from having full control of their property, over claims of 'insecurity'.
And complaints of this nature get inane drivel responses of "lol just fork Graphene"
This is a really, really poor-quality take.
> complaints of this nature get inane drivel responses of "lol just fork Graphene"
It’s a fork of AOSP, which you can just…use.
Its only since the smartphone era (2008) with locked down shit devices has this view changed. And people challenging this are somehow defective, tone policed, shamed, or likewise.
GrapheneOS users are treated as 'rooted phones', at the exact same time tools that would attack and prevent corporate surveillance (xprivacy, etc) are withheld cause they would involve root.
Even this thread is full of a lot of anti-owner hand wavey shit that amounts to 'we don't trust our users, and fork you'. https://discuss.grapheneos.org/d/18953-why-the-stigma-agains...
No, that’s called sharing your opinion.
You shared your opinion, someone else shared there’s that just so happened to be “I disagree with you” and suddenly that’s some type of censorship? Nobody is shaming you, either.
Leave the abusive relationship with those entities. Don’t lay this at the feet of the GrapheneOS Project.
If you read their FAQ, you’ll see how limited the OS actually is in retaining your privacy if you still insist on using these providers that don’t respect you.
Said another way: stop trying to solve human problems with technical means.
and definitely stop trying to get others to do it for you for free.
Or, continue: I’m not a cop.
It is a common userspace decision to lock things to userspace. It’s good hygiene.
If you want less-secure software, use AOSP or one of its many forks.
You’re not defective: you just have different needs and threat model,
and you’re harassing and degrading the public image of a project that’s opinionated in a very welcome way by folks in the security community - especially those who value stability and usability.
Yes, running in userspace for the majority of tasks is good hygiene.
Preventing the user from ever escalating beyond that layer on their own devices, however, is restricting their freedom to control their device. When that happens with tractors, cars or other gadgets that's considered anti-user. The same attitude should extend to phones.
You have complete control of the device.
You choose to lock certain things when using GrapheneOS. That’s their security model.
If you want to argue that, go study it and argue that.
If your threat model is different, if your desired security model is different, then: it’s not for you, use one of many other options.
Like all software projects, it doesn’t necessarily exist for you - or anyone specifically.
It’s not harming you for it to exist.
https://news.ycombinator.com/newsguidelines.html
Thanks.
Also, I've seen such audits internally, and they don't care about security at all. They care about the theatrics of security waaaaay more.
For example, I was at Santander in 2024, during its huge data breach. Here is the list of actions which are supposed to prevent the same kind of attacks again in the future:
-
Yeah, it's an empty list.
But of course, they made our life more difficult. In the end, I literally had more permission than before, because they were even sloppier than before. But of course, I had to change my password more frequently, and I had to type it about 5x more.
I'd wager that if it doesn't really hurt their bottom line to not support GrapheneOS, they won't really care.
That would make a great blog post
Mistakes happen and ya can't fix what you don't know about. Always report issues.
Also strongly consider just using the website.
I had to update exploit protection after their latest update — I think it was enabling dynamic code loading via both memory and storage that did the trick.
Edit: checked now, I have also disabled secure app spawning.
(Rather than something fundamentally incompatible, like them using Play Integrity)
IMO headline is very misleading, and OP should have tried disabling all exploit protection options before jumping to any conclusions. PayPal isn't actively trying to block GrapheneOS as of now.
It reduces security of the app itself, but doesn't affect security of the phone by much.
Secure spawning doesn't cause compatibility issues with non-buggy apps (unlike blocking dynamic code loading via memory/storage or native debugging) and apps rarely have issues with it (unlike memory tagging, which finds lots of bugs) so it's on by default.
Play Integrity API: Not blocked
Hardened memory allocator: Enabled
Memory tagging: Enabled
Extended virtual address space: Enabled
Secure app spawning: Enabled
Native code debugging: Allowed
WebView JIT: Disabled
Dynamic code loading via memory: Allowed
Dynamic code loading via storage: Allowed
I think this is the problem here.
A lot of NFC related tech is deeply rooted in having "trusted (aka large company)", "attested (aka you can't easily lie)", secure module functionality.
What should have happened is to just not enable the contactless payment functionality for given app, even if the user enabled it in general. And not crash.
Also as others have pointed out, this might be an accidental mishap not an intended outcome.
But it's not like PayPal is known to care about small user-base edge cases (quite the opposite). Which I guess is the actual root problem.
Version 8.107.0
com.paypal.android.p2pmobile
https://support.google.com/googleplay/android-developer/answ...
PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.
https://wero-wallet.eu
What do you mean "some banks"? I thought the whole value proposition of Wero was instant bank transfers with SEPA but using phone numbers?
On the payment provider technology side, you're right, but the wallet feature uses phone numbers (and I think email addresses) so you can send each other money without sharing your IBAN (which is slightly longer and probably not in your contacts).
I've read once that there are paid app testing labs which test if an app has root and custom ROM detection and when they don't have that it's a minus point on the report.
UK politics has been quite isolationist, though, so I doubt the banks will see much in interoperating with the rest of Europe.
We have per-app toggles for exploit protections known to have compatibility issues. Secure spawning wasn't expected to cause any compatibility issues so we didn't have a per-app toggle for it until recently but it's available now.
Even tried completely nuking app data and logging in again. Login, security check, fingerprint setup, everything worked (I even got the alert that it used the Play Integrity API)
I assume if anything, this is probably the contactless payments. I do somewhat understand why they are really trying to lock something like this down, but as everyone pointed out, giving the green light to a CVE infested version of Android while prohibiting the use of a version that goes above and beyond when it comes to security is absurd.
Hanlon's Razor is a useful tool. https://en.wikipedia.org/wiki/Hanlon%27s_razor
Several of the more aggressive exploit protections are enabled for the base OS but are opt-in for user-installed apps. Memory tagging should work with all user installed apps but is opt-in because it's so good at detecting invalid memory accesses and uncovers a lot of bugs. Dynamic code loading via storage, dynamic code loading via memory and native debugging are allowed by default since a significant fraction of apps need those and it's not usually a bug. Users can set those as enabled by default for user installed apps which is particularly recommended for memory tagging but then people need to deal with the incompatibilities. The defaults don't cause issues with most apps so not everyone is aware of the per-app toggles.
Jokes on you though, I'm neither of those things.
I've been called worse.
This is evil in itself.
There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.
So, best to grow the user base fast now and let every user send a complaint for every app that gets blocked. A few million users will be harder to ignore.
I also get why they'd be desperate to fight bots. It's a weak excuse for not doing it better, but at least it makes some sense.
https://arstechnica.com/gadgets/2026/08/motorolas-grapheneos...
Have you tried the per-app exploit protection compatibility mode or the finer-grained toggles for those apps? 90% of banking apps work on GrapheneOS but MANY have problematic anti-tampering code requiring the per-app compatibility mode.
https://grapheneos.social/@GrapheneOS/117045625230764434
GrapheneOS officially passes only the MEETS_BASIC_INTEGRITY tier of the Google Play Integrity API and fails the MEETS_DEVICE_INTEGRITY and MEETS_STRONG_INTEGRITY levels.
Many banking apps I use in my country require this level plus something from the GPI API, which makes them unusable. You need a regular, unmodified smartphone to use them.
But GrapheneOS isn't root, that's just PayPal's thing being broken.
If they want to ban arbitrary operating systems, they can use attestation and it can't be fooled the way you're describing. Apps doing this can explicitly verify GrapheneOS and we've convinced some apps to do that. We've also convinced a smaller number to stop doing that at all.
Funnily enough, the only way to hide those detections was to Root my phone... And i still remember when i had an appointment there, they wanted to see something in my Bank app, i opened it (and i assume it had an update since i then last used it) and a big "THIS DEVICE IS NOT SUPPORTED. ROOT IS NOT SUPPORTED" poped up
But was as simple as readding the bank app to my root hiders.
but still, i hate this security theater
Tap-to-pay is unlikely to be provided via their website and does work on GrapheneOS.
I use latest Aurora Store PayPal version and it still works. I just dont use contactless payment.
There's some countries with very bad financial sector where your option is PayPal or Western Union as the local banks don't know how to do international transfers, Remitly doesn't support all countries and Wise also doesn't work. PayPal works, even if they charge fees.
It was a big reality check for me usually living in Germany and having access to a lot of banks and modern neo-banks.
One of the ladies at daycare is leaving? Here's a paypal link to chip in for a good-bye present.
Split a take-out order with a German friend, but he paid? Here's his paypal to send him your share.
It's just assumed that everyone has paypal over here...
Depending on which state you are in, your experience can be vastly different.
All the states used to be kinda independent two hundred years ago. Including having different currencies. Unification happened 1871. Bismarck and later Hitler kinda brought the nation together, but after losing two world wars national pride got frowned upon and having the iron curtain cut through the country didn't help in fostering a German identity, either. Reunification was only 36 years ago. Though, about a third to maybe half of the German territory remains lost after losing the wars. Instead we got the EU. The more things change, the more they stay the same.
It's always funny to see foreigners make fun of German supposed clichés that I never had any exposure to whatsoever, like Lederhosen, which is only a thing in Southern Germany.
The whole "I pay this time you pay next time" is already covered by "everybody brings a case once in a while", but if the guys without cars just ask someone else to pay for it when it's their turn it won't add up.
If you're going to make assumptions, perhaps start with those that don't paint me in a bad light.
If this was a long time friend, I'd let it slide. It's just a case of beer, and in Germany beer is dirt cheap. If this was a new acquaintance, I'd let it slide and take note that it's not a person to make friends with.
> If you're going to make assumptions, perhaps start with those that don't paint me in a bad light.
Good point. But all of this isn't a problem of payment systems, but of people's behaviour.
I know many adults who believe that splitting bills is a normal and reasonable thing to do.
These are etiquette rules, which have their benefits. Since nobody is forced to follow etiquette, they help you to learn things about people.
Generosity is one of the easiest life hacks to find out who is friendly towards you and who is not. If you buy them a drink and they won't buy you a drink back, that's a tiny cost for you to know what kind of fellow you're dealing with. If they buy you a drink and then asks you to transfer money to them, you also learn something about them. If people splitting bills want to sit and count to make sure that everybody pays exactly for what they had, then you learn something. And so on.
If you invite people for dinner a few times, you will learn something about that person whether you wanted to or not.
[0] https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direc...
One-off SEPA Direct Debit is virtually unheard of, recurring payments are a bit more common but usually involve a €0,01 payment to prove ownership of the account. The transactions are also trivial to undo, and can only be initiated by companies.
So no, "IBAN fraud" isn't a thing in practice. You can safely share your IBAN with your friends for instant free wire transfers.
But for the small person-to-person type thing, paypal is the defacto here (sadly).
It may also require dynamic code loading via storage, dynamic code loading via memory and native debugging being permitted but those aren't blocked for user installed apps by default. People can opt-in to those being enabled by default for user installed apps similarly to memory tagging, but memory tagging has the biggest positive impact.
You may also not have the update yet. Play Store supports staged rollouts where updates are only available to a set percentage of users.
You may also not have the update yet. Play Store supports staged rollouts where updates are only available to a set percentage of users.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
Starling Bank app still works on GrapheneOS too. See here:
https://github.com/PrivSec-dev/banking-apps-compat-report/is...
PayPal's app does still work on GrapheneOS, they only accidentally broke it with the default settings due to bugs in their anti-tampering code. Disabling the per-app exploit protection compatibility mode works around it. They should fix it and start testing on GrapheneOS.
It's one of the toggles changed by the per-app exploit protection compatibility mode. If an app doesn't work, that's the first thing to try. It can then be narrowed down to a specific setting.
The more aggressive exploit protections uncovering a lot of compatibility issues are only enabled for the base OS and specific user installed apps by default. Those can be set to enabled by default for all user installed apps and then people have to deal with the per-app toggles a lot more. This applies to memory tagging, disallowing dynamic code loading via memory/storage and disallowing native debugging (ptrace).
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
You can help by upvoting the update they posted with the solution:
https://news.ycombinator.com/item?id=49462575
They could've simply neutrally stated that: "PayPal crashes when I try and run it under GrapheneOS" and that would be a true statement without assigning blame or malice. But, not knowing PayPal was innocence, they chose to assign malice to them instead. That's a choice. That is rash judgement and calumny.
Their app can also still be used on GrapheneOS. It just requires the per-app secure spawning toggle due to a recently added app bug.
GrapheneOS is an operating system rather than read-only memory firmware. There's a ROM in early boot (boot ROM) which loads the SoC boot firmware from the SSD which loads other SoC firmware from the SSD and then loads the OS from the SSD.
The vast majority of Android apps including PayPal work fine on GrapheneOS.
PayPal recently shipped incorrect anti-tampering code incompatible with our secure spawning feature. The feature spawns app processes with exec to provide their own address space layout randomization, random memory tags and canaries. We're aware of these kinds of incompatibilities and provide a per-app toggle for exec-based spawning which works for PayPal. PayPal made a mistake and didn't consider GrapheneOS as part of this recent change. They'll likely fix it since they don't ban using GrapheneOS and likely want it working on GrapheneOS.
The OS is designed to offer privacy and security guarantees, which root access breaks, so they don't offer it.
Because your argument sounds like you gave the admin password to someone else to prevent yourself from tampering with your computer for the security reasons
GrapheneOS has never received or applied for any government grants. It doesn't have any involvement with any governments. GrapheneOS is banned by the Play Integrity API device and strong integrity levels. In practice, the only app compatibility issues which can't be worked around with our compatibility issues are apps adopting the Play Integrity API to enforce those.