Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: PayPal blocks GrapheneOS

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 361 posts

Re: Tell HN: PayPal blocks GrapheneOS

#161

Post by dathinab »

shaky-carrousel wrote: post #151

It works here. Running in a work profile, no contactless payments. Play Integrity API: Not blocked Hardened memory allocator: Enabled Memory tagging: Enabled Extended virtual address space: Enabled Secure app spawning: Enabled Native code debugging: Allowed WebView JIT: Disabled Dynamic code loading via memory: Allowed Dynamic code loading via storage: Allowed

> no contactless payments.

I think this is the problem here.

A lot of NFC related tech is deeply rooted in having "trusted (aka large company)", "attested (aka you can't easily lie)", secure module functionality.

What should have happened is to just not enable the contactless payment functionality for given app, even if the user enabled it in general. And not crash.

Also as others have pointed out, this might be an accidental mishap not an intended outcome.

But it's not like PayPal is known to care about small user-base edge cases (quite the opposite). Which I guess is the actual root problem.

Re: Tell HN: PayPal blocks GrapheneOS

#165

Post by RunSet »

fluidcruft wrote: post #47
axegon_ wrote: post #17

This is arguably the most irritating thing with just about every largecorp developer: "os that hasn't been updated in 6 years? Sure boss!". Os that is built specifically around security and privacy with daily updates: "No, you can't do that". Annoying - yes. Safe way to make sure I will stop being your customer - also YES!

Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors). Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good g…

> Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies.

A more apt analogy might be game developers who demand admin rights so they can install a rootkit to detect "cheating".

Re: Tell HN: PayPal blocks GrapheneOS

#166

Post by microtonal »

zerof1l wrote: post #8

I see this happen from time to time. Lately, almost all of the apps work fine on GrapheneOS. The best strategy is to keep writing the business once every two or so weeks that you can’t log in to and use the app. Don’t go too technical at first, because most of the time, the moment they hear things like “rooted” or “unofficial,” they just say your phone is the issue. To date, I was able to convince, or at least contri…

I think in this case it's also them just introducing a new check that either GrapheneOS will need to work around or Paypal needs to refine. I can reproduce the issue, but it doesn't seem like it did a failed Play Integrity check at that point.

Re: Tell HN: PayPal blocks GrapheneOS

#168

Post by gvurrdon »

kevin_thibedeau wrote: post #153
fluidcruft wrote: post #47

Earlier quoted context omitted.

Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors). Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good g…

The cherry on top is that their web site invariably still works so the refusal to work via app is an intentional manipulation tactic to harvest more consumer data for sale.

Sadly, their website now appears to require an app in order to sign in. Even before that it would often block me with text along the lines of "We don't know who you are, call our support number."

Re: Tell HN: PayPal blocks GrapheneOS

#169

Post by microtonal »

shaky-carrousel wrote: post #151

It works here. Running in a work profile, no contactless payments. Play Integrity API: Not blocked Hardened memory allocator: Enabled Memory tagging: Enabled Extended virtual address space: Enabled Secure app spawning: Enabled Native code debugging: Allowed WebView JIT: Disabled Dynamic code loading via memory: Allowed Dynamic code loading via storage: Allowed

Doesn't work here. No contactless payments, full Exploit protection compatibility mode.

Re: Tell HN: PayPal blocks GrapheneOS

#170

Post by john_strinlai »

axegon_ wrote: post #88
fluidcruft wrote: post #47

Earlier quoted context omitted.

Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors). Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good g…

That's your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don't have to legally be adult to buy any of the things you'd need and I say that as someone who only struggled with chemistry in school, that's now low the bar is. What's the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronom…

physical risks, like your example, do not map well to digital risks faced by large international companies.
Post reply on HN