Birbla

Tell HN: PayPal blocks GrapheneOS

Tell HN: PayPal blocks GrapheneOS

428 pointsby leumon251 comments

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Confirmed on my phone too. I left a 1-star review on the play store saying it crashes on every launch, uninstalled and will use the website from now on. (Luckily, I dont use contactless payments, ai just send and receive money from friends from time to time)
    by prartichoke
  • You can solve it with the per-app toggle for disabling secure spawning. PayPal only accidentally broke compatibility with secure spawning. You should still complain to them about it.
    by grapheneos
  • Has PayPal blocked GrapheneOS, or have they blocked every OS they're unable to verify and done a poor job of implementing their checks?

    Hanlon's Razor is a useful tool. https://en.wikipedia.org/wiki/Hanlon%27s_razor

    by onion2k
  • They have blocked rooted phones based on the error provided. Nothing to do with verification. They treat rooted phones to a level they don't with phones without critical security updates. That's the tension. Non-rooted phones aren't necessarily unsafer.
    by bossyTeacher
  • > have they blocked every OS they're unable to verify

    This is evil in itself.

    by basilikum
  • Hanlon's razor is for people. Organizations do not operate like people and do not deserve the same deference.
    by skinfaxi
  • You're a banking app. Why do you need to check my phone or my os? The security is not in what phone I use, but in how sane your 2-factor auth is and if even exists.
    by redleader55
  • PayPal accidentally broke support for GrapheneOS with the default settings for the app by adding incorrect anti-tampering code. It can be worked around using the per-app toggle to disable secure spawning. It shouldn't be necessary and we didn't expect there to be apps incompatible with secure spawning so we didn't originally design it to have a per-app toggle and had to add it.

    Several of the more aggressive exploit protections are enabled for the base OS but are opt-in for user-installed apps. Memory tagging should work with all user installed apps but is opt-in because it's so good at detecting invalid memory accesses and uncovers a lot of bugs. Dynamic code loading via storage, dynamic code loading via memory and native debugging are allowed by default since a significant fraction of apps need those and it's not usually a bug. Users can set those as enabled by default for user installed apps which is particularly recommended for memory tagging but then people need to deal with the incompatibilities. The defaults don't cause issues with most apps so not everyone is aware of the per-app toggles.

    by grapheneos
  • Ironically, I had to apply Hanlon’s Razor to the impolite tone of your post
    by y-curious
  • It is a useful tool, but is largely irrelevant to this issue. To the end user, this isn't really much of a difference. Whether the cause is malice or simply not choosing to use the smallest effective brush, they are still taking an action that is preventing legitimate users from accessing the service.
    by 4chandaily
  • The very fact they've managed to convince anyone that checking what OS I decide to run on the devices I own to check my own banking is any of their concern is a problem in and of itself.
    by folkrav
  • I have never been a crypto currency advocate, but if the banking utility of a mobile phone is going to be dictated by the operating systems that finance apps whitelist, I might want open rails that work with my open phone
    by enos_feedler
  • Can it still run in browser like it would on a regular pc?
    by gnoll_of_gozag
  • I wish it ran in Firefox on my pc...
    by Aachen
  • Yes, but you might have to enable desktop mode on a mobile browser so it doesn't try force-spawning the app.
    by qingcharles
  • Yes, but the app still works on GrapheneOS. They accidentally broke compatibility with the default settings with incorrect anti-tampering code. Disabling the per-app toggle for secure spawning works around it.

    We have per-app toggles for exploit protections known to have compatibility issues. Secure spawning wasn't expected to cause any compatibility issues so we didn't have a per-app toggle for it until recently but it's available now.

    by grapheneos
  • I'm on Debian Testing sometimes on amd64 and sometimes on m1. Paypal also doesn't like me. Than I have two options: I use a Windows VM to do the payment or I use another payment method. Most of the time I use the other payment method.
    by ThomasGlanzmann
  • Switched to Wero and haven't looked back.

    https://wero-wallet.eu

    by aabdelhafez
  • Does this work in the UK?
    by savwolf
  • The website is pages and pages of blankness for me on Firefox mobile.
    by oniony
  • Sadly, not even close. I would even dare to say that Klarna is closer to what PayPal is, than Wero.
    by Carbon1603
  • wait for it... I can see a future were every wallet, payment etc. app will block devices which are on custom ROMs and do not pass strong hardware integrity with blessing from Google.

    I've read once that there are paid app testing labs which test if an app has root and custom ROM detection and when they don't have that it's a minus point on the report.

    by therealmarv
  • You need to use your bank's app for Wero, and many EU banks' apps refuse to run on GrapheneOS for the same reasons as PayPal. This is sadly not a clear win for Wero.
    by muvlon
  • Unfortunately peasants like us who don't live in the 5 countries where it's available still can't look back
    by unpopularopp
  • Wero is not a PayPal alternative. It doesn't even have buyer's protection and every bank must manually implement it which immediately makes it a failure. Some banks also connect it to your phone number so you can't link Wero to two different bank accounts with the same number when you have 2 bank accounts. Very messy.
    by sunaookami
  • I'm starting to see these restrictions as a deterrent for using the products in question. My GOS handset is slowly fizzling away into a dumbphone with Firefox, organic maps and k9. And you know what, I am starting like it.
    by sdcfgy
  • The vast majority of Android apps work on GrapheneOS. App compatibility is not diminishing in any significant way. We've improved app compatibility faster than Play Integrity API adoption has happen, which this isn't.

    PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.

    by grapheneos
  • It works here. Running in a work profile, no contactless payments.

    Play Integrity API: Not blocked

    Hardened memory allocator: Enabled

    Memory tagging: Enabled

    Extended virtual address space: Enabled

    Secure app spawning: Enabled

    Native code debugging: Allowed

    WebView JIT: Disabled

    Dynamic code loading via memory: Allowed

    Dynamic code loading via storage: Allowed

    by shaky-carrousel
  • This is my setup as well, though with JIT enabled (which is the default). Crashing at launch on:

        version 10.10.0

    com.paypal.android.p2pmobile
    versionCode 1160090162
    Seems pretty likely a flawed root detection being rolled out (given the stack trace), my phone is not rooted.
    by Groxx
  • Doesn't work here. No contactless payments, full Exploit protection compatibility mode.
    by microtonal