[flagged]
Tell HN: PayPal blocks GrapheneOS
271–280 of 361 posts
Re: Tell HN: PayPal blocks GrapheneOS
#272I still don't understand why people atill use paypal. It has veena shitty and shady company from the start and never got any better. They are known thieves that use political games to illegally seize money and get to keep it until you "prove" that $100 is yours and not used for random bs like "terrorism".
Re: Tell HN: PayPal blocks GrapheneOS
#273Earlier quoted context omitted.
Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors). Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good g…
Yea, years ago I was in the security space and got to talk to some paypal security folks at a symposium in San Diego. The level of stuff that they have to deal with is so extreme. It's similar to how people don't like sites blocking entire countries or access from Tor, etc. You might be doing it for privacy...but all the people trying to commit fraud are also using those same channels to hide their identity. The bloc…
This is interesting. You're gesturing at the idea that individual security practices can be at odds with those needed for group security. I'll be pondering on this.
Re: Tell HN: PayPal blocks GrapheneOS
#274Earlier quoted context omitted.
Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors). Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good g…
That's your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don't have to legally be adult to buy any of the things you'd need and I say that as someone who only struggled with chemistry in school, that's now low the bar is. What's the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronom…
[dead]
Re: Tell HN: PayPal blocks GrapheneOS
#275Earlier quoted context omitted.
You can wipe the device and reinstall whatever at any time. You have complete control of the device. You choose to lock certain things when using GrapheneOS. That’s their security model. If you want to argue that, go study it and argue that. If your threat model is different, if your desired security model is different, then: it’s not for you, use one of many other options. Like all software projects, it doesn’t nece…
[flagged]
Hey, stop wrecking my favorite community with non-debates, it’s done better here.
https://news.ycombinator.com/newsguidelines.html
Thanks.
Re: Tell HN: PayPal blocks GrapheneOS
#276Earlier quoted context omitted.
Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors). Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good g…
That's your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don't have to legally be adult to buy any of the things you'd need and I say that as someone who only struggled with chemistry in school, that's now low the bar is. What's the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronom…
Do you like science?
I propose you buy enough ingredients from the supermarket and make a big batch.
The scientific test is: how far do you get, before your door is kicked in?
If that fails, then science #2: have fun lighting it!!
You almost win both ways. (although I admit I wouldn't fund you even via a trustworthy intermediary say a Kickstarter campaign.
Re: Tell HN: PayPal blocks GrapheneOS
#277Earlier quoted context omitted.
That's your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don't have to legally be adult to buy any of the things you'd need and I say that as someone who only struggled with chemistry in school, that's now low the bar is. What's the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronom…
The problem here seems to be that the phone is detected as rooted, not specifically that it's running grapheneOS. But I agree that it's a big problem. That's how you end up in a situation where google has full control from hardware to final apps like on iphones. When devs assume that everybody is using the stock android with google services enabled.
How did we let "rooting" become some evil thing?
It's normal to have root (or Administrator) on your devices. After all, they are yours. They don't belong to the device manufacturer. You should have full access to your own devices by default.
Only recently did we somehow normalize the idea that the user should not be the ultimate decider over their own devices.
Re: Tell HN: PayPal blocks GrapheneOS
#278Earlier quoted context omitted.
So it's not PayPal blocking GrapheneOS?
sounds more like grapheneos blocking paypal!
No, they added incorrect anti-tampering code. It's wrongly detecting secure app spawning giving each app their own address space, memory tags, etc. via exec as tampering.
Re: Tell HN: PayPal blocks GrapheneOS
#279[flagged]
Android remains open source via the Android Open Source Project.
The vast majority of Android apps including PayPal work fine on GrapheneOS.
PayPal recently shipped incorrect anti-tampering code incompatible with our secure spawning feature. The feature spawns app processes with exec to provide their own address space layout randomization, random memory tags and canaries. We're aware of these kinds of incompatibilities and provide a per-app toggle for exec-based spawning which works for PayPal. PayPal made a mistake and didn't consider GrapheneOS as part of this recent change. They'll likely fix it since they don't ban using GrapheneOS and likely want it working on GrapheneOS.
Re: Tell HN: PayPal blocks GrapheneOS
#280[flagged]
PayPal works well on GrapheneOS. PayPal shipped incorrect anti-tampering code wrongly detecting our secure spawning feature as tampering. It works fine when the per-app toggle for secure spawning is disabled. These incompatibilities with hardening features are relatively common in banking apps. We provide an overall exploit protection compatibility mode toggle for ease of use rather than people needing to figure out which feature is incompatible.
GrapheneOS has never received or applied for any government grants. It doesn't have any involvement with any governments. GrapheneOS is banned by the Play Integrity API device and strong integrity levels. In practice, the only app compatibility issues which can't be worked around with our compatibility issues are apps adopting the Play Integrity API to enforce those.