Tell HN: PayPal blocks GrapheneOS • Hacker News Board

Re: Tell HN: PayPal blocks GrapheneOS

#281

Post by grapheneos » Fri, Aug 28, 2026, 3:24 AM UTC

imska wrote: post #63

nunobrito wrote: post #25

[flagged]

It does work for me on lineages for microg with an Xperia 5 II. Haven't tried to activate contactless though.

PayPal works fine on GrapheneOS too. They recently shipped an update with incorrect anti-tampering code incompatible with our secure spawning feature. It can be worked around by toggling off secure spawning as the creator of this thread figured out on their own. For ease of use, we have a simple per-app exploit protection compatibility mode setting all these features to a compatibility mode instead of people needing to figure it out.

Re: Tell HN: PayPal blocks GrapheneOS

#282

Post by grapheneos » Fri, Aug 28, 2026, 3:26 AM UTC

Sophira wrote: post #69

tensegrist wrote: post #19

Earlier quoted context omitted.

iirc grapheneos can't be rooted unless you do your own build

[flagged]

Replacing a large portion of the core operating system code and SELinux policies with a third party project is making a derivative of the OS. It can no longer receive standard updates anymore and won't pass verified boot without resigning it. A derivative of GrapheneOS with significantly different code, SELinux policies and distinct signing keys is not GrapheneOS. Verified boot will no longer work as intended anymore even after resigning and the same applies to a large portion of the security model in the OS. Giving root to a huge portion of the OS greatly reduces security even if it's never granted to any apps.

Re: Tell HN: PayPal blocks GrapheneOS

#283

Post by grapheneos » Fri, Aug 28, 2026, 3:29 AM UTC

iqra_c wrote: post #258

[flagged]

PayPal doesn't ban GrapheneOS. They accidentally broke compatibility with secure app spawning (exec-based app process spawning). It can be worked around by disabling secure spawning for the app. That's done automatically by the simple per-app exploit protection compatibility mode which sets all of these exploit protection toggles to the compatibility mode.

Re: Tell HN: PayPal blocks GrapheneOS

#284

Post by grapheneos » Fri, Aug 28, 2026, 3:31 AM UTC

hoshi73 wrote: post #44

Did you try enabling the exploit protection compatibility mode in the app settings? GrapheneOS should have shown you a Play Integrity API detection notification if the app is actively trying to block non-GMS-certified devices using Play Integrity API.

This is a correct answer despite the fact that it was previously hidden by flagging. PayPal's recent updates with incorrect anti-tampering code work fine on GrapheneOS when secure app spawning is disabled. It's best to disable only secure app spawning (exec-based spawning) for it instead of using the whole compatibility mode. Using the whole compatibility mode is the first thing to check before narrowing it down though.

Re: Tell HN: PayPal blocks GrapheneOS

#285

Post by grapheneos » Fri, Aug 28, 2026, 3:33 AM UTC

freakynit wrote: post #2

[flagged]

GrapheneOS isn't rooted. PayPal works on GrapheneOS and doesn't try to ban using it. However, they recently shipped incorrect anti-tampering code incompatible with our secure app spawning feature (exec-based app process spawning). It can be worked around by disabling the per-app secure spawning toggle for PayPal. For simplicity, there's a per-app exploit protection compatibility mode toggle which sets all the finer grained exploit protection toggles to the compatibility mode.

GrapheneOS is an operating system rather than read-only memory firmware. There's a ROM in early boot (boot ROM) which loads the SoC boot firmware from the SSD which loads other SoC firmware from the SSD and then loads the OS from the SSD.

Re: Tell HN: PayPal blocks GrapheneOS

#286

Post by ButlerianJihad » Fri, Aug 28, 2026, 3:34 AM UTC

grapheneos wrote: post #284

hoshi73 wrote: post #44

Did you try enabling the exploit protection compatibility mode in the app settings? GrapheneOS should have shown you a Play Integrity API detection notification if the app is actively trying to block non-GMS-certified devices using Play Integrity API.

This is a correct answer despite the fact that it was previously hidden by flagging. PayPal's recent updates with incorrect anti-tampering code work fine on GrapheneOS when secure app spawning is disabled. It's best to disable only secure app spawning (exec-based spawning) for it instead of using the whole compatibility mode. Using the whole compatibility mode is the first thing to check before narrowing it down thou…

So the OP is just lying out of ignorance and rash judgement, and spreading calumny about PayPal. And PayPal has done nothing to their app to block GrapheneOS. And hundreds, thousands of participants on HN have been misled by another rogue "Tell HN". Good times.

Re: Tell HN: PayPal blocks GrapheneOS

#287

Post by grapheneos » Fri, Aug 28, 2026, 3:34 AM UTC

therealmarv wrote: post #23

leumon wrote: post #3

Earlier quoted context omitted.

Well I haven't rooted my device. It's just normal grapheneos

[flagged]

GrapheneOS isn't rooted. PayPal works on GrapheneOS and doesn't try to ban using it. However, they recently shipped incorrect anti-tampering code incompatible with our secure app spawning feature (exec-based app process spawning). It can be worked around by disabling the per-app secure spawning toggle for PayPal. For simplicity, there's a per-app exploit protection compatibility mode toggle which sets all the finer grained exploit protection toggles to the compatibility mode.

Re: Tell HN: PayPal blocks GrapheneOS

#288

Post by grapheneos » Fri, Aug 28, 2026, 3:38 AM UTC

ButlerianJihad wrote: post #286

grapheneos wrote: post #284

Earlier quoted context omitted.

This is a correct answer despite the fact that it was previously hidden by flagging. PayPal's recent updates with incorrect anti-tampering code work fine on GrapheneOS when secure app spawning is disabled. It's best to disable only secure app spawning (exec-based spawning) for it instead of using the whole compatibility mode. Using the whole compatibility mode is the first thing to check before narrowing it down thou…

So the OP is just lying out of ignorance and rash judgement, and spreading calumny about PayPal. And PayPal has done nothing to their app to block GrapheneOS. And hundreds, thousands of participants on HN have been misled by another rogue "Tell HN". Good times.

They're not lying but rather likely didn't know about the per-app exploit protection compatibility mode. They narrowed it down to secure app spawning needing to be disabled. Now they know what to do when an app doesn't work on GrapheneOS.

You can help by upvoting the update they posted with the solution:

https://news.ycombinator.com/item?id=49462575

Re: Tell HN: PayPal blocks GrapheneOS

#289

Post by grapheneos » Fri, Aug 28, 2026, 3:42 AM UTC

gib444 wrote: post #242

leumon wrote: post #9

Earlier quoted context omitted.

With. But disabling "Secure app spawning" seems to fix it for now.

Ew that's a nasty workaround. But interesting to know!

Secure app spawning is a per-app toggle now so it doesn't reduce OS security or the security of other apps without it disabled. It only reduces security of the app with it set to disabled. If multiple apps have it disabled, they share the same ASLR bases, memory tags for memory allocated before fork and other things.

It's one of the toggles changed by the per-app exploit protection compatibility mode. If an app doesn't work, that's the first thing to try. It can then be narrowed down to a specific setting.

The more aggressive exploit protections uncovering a lot of compatibility issues are only enabled for the base OS and specific user installed apps by default. Those can be set to enabled by default for all user installed apps and then people have to deal with the per-app toggles a lot more. This applies to memory tagging, disallowing dynamic code loading via memory/storage and disallowing native debugging (ptrace).

Re: Tell HN: PayPal blocks GrapheneOS

#290

Post by grapheneos » Fri, Aug 28, 2026, 3:45 AM UTC

tensegrist wrote: post #19

freakynit wrote: post #2

[flagged]

iirc grapheneos can't be rooted unless you do your own build

There's only root if people make a userdebug build with user-accessible root or make a derivative of GrapheneOS with major modifications. The production builds don't have uncontained root since it would greatly roll back the security model. Only a few core processes run as a limited subset of root.