Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: PayPal blocks GrapheneOS

news.ycombinator.com

Post reply on HN
Print view View original

301–310 of 361 posts

Re: Tell HN: PayPal blocks GrapheneOS

#301

Post by grapheneos »

fluidcruft wrote: post #47
axegon_ wrote: post #17

This is arguably the most irritating thing with just about every largecorp developer: "os that hasn't been updated in 6 years? Sure boss!". Os that is built specifically around security and privacy with daily updates: "No, you can't do that". Annoying - yes. Safe way to make sure I will stop being your customer - also YES!

Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors). Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good g…

There's no tension between the security of PayPal against bad actors and support for GrapheneOS. GrapheneOS preserves the whole standard security model and greatly improves security. It's far more secure than anything permitted by the Play Integrity API device or strong integrity levels.

Thankfully, PayPal hasn't banned GrapheneOS and their app still works on it. They accidentally broke compatibility with our secure app spawning feature which has a per-app toggle to disable it along with the other exploit protections which can cause compatibility issues.

There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.

Re: Tell HN: PayPal blocks GrapheneOS

#302

Post by grapheneos »

svpk wrote: post #228
HenriTEL wrote: post #189

Earlier quoted context omitted.

The problem here seems to be that the phone is detected as rooted, not specifically that it's running grapheneOS. But I agree that it's a big problem. That's how you end up in a situation where google has full control from hardware to final apps like on iphones. When devs assume that everybody is using the stock android with google services enabled.

GrapheneOS is not rooted. The phone not being rooted is part of the GrapheneOS' security model. I assume the issue is it failing the deeper play integrity check which is about it not being "Google approved."

It isn't due to the Play Integrity API. That shows a notification on GrapheneOS with a toggle for blocking it to work around it for services not enforcing providing a result. If that was the issue, the original poster would have known from the notification. The issue ended up being PayPal shipping incorrect anti-tampering code incompatible with secure spawning. The original poster figured that out and got it working by disabling the per-app secure spawning toggle.

Re: Tell HN: PayPal blocks GrapheneOS

#303

Post by grapheneos »

Melatonic wrote: post #222
HenriTEL wrote: post #189

Earlier quoted context omitted.

The problem here seems to be that the phone is detected as rooted, not specifically that it's running grapheneOS. But I agree that it's a big problem. That's how you end up in a situation where google has full control from hardware to final apps like on iphones. When devs assume that everybody is using the stock android with google services enabled.

[flagged]

It does not have a root privilege mode. GrapheneOS doesn't weaken any aspect of the standard security model. It has all of the standard security model and features including hardware-based security intact. It greatly improves security rather than doing that.

User accessible root access is available in userdebug (non-production) builds. There's no system for granting root access to apps. It's no different from the stock OS in this regard, but it's a lot more secure than the stock OS.

Re: Tell HN: PayPal blocks GrapheneOS

#304

Post by grapheneos »

fluidcruft wrote: post #126
iamnothere wrote: post #115

Earlier quoted context omitted.

Graphene OS does not support root. This is a false positive based on some check they are doing.

It's probably just a generic error message for failing that Google Play Protect thingamajigger that attests provenance of the vendor OS from boot. Will be interesting to see whether the Motorola phones have this endorsement when they ship. Most devices would probably fail because they are rooted rather than because they are GrapheneOS. I wouldn't put it past a scammer talking grandma into rooting their phone.

It isn't due to the Play Integrity API. That shows a notification on GrapheneOS with a toggle for blocking it to work around it for services not enforcing providing a result. If that was the issue, the original poster would have known from the notification. The issue ended up being PayPal shipping incorrect anti-tampering code incompatible with secure spawning. The original poster figured that out and got it working by disabling the per-app secure spawning toggle.

Re: Tell HN: PayPal blocks GrapheneOS

#305

Post by grapheneos »

br0ceph wrote: post #245
fluidcruft wrote: post #126

Earlier quoted context omitted.

It's probably just a generic error message for failing that Google Play Protect thingamajigger that attests provenance of the vendor OS from boot. Will be interesting to see whether the Motorola phones have this endorsement when they ship. Most devices would probably fail because they are rooted rather than because they are GrapheneOS. I wouldn't put it past a scammer talking grandma into rooting their phone.

[flagged]

It will be possible to install the official GrapheneOS on the devices. Shipping devices with the official GrapheneOS is planned but may not be there at launch.

Re: Tell HN: PayPal blocks GrapheneOS

#306

Post by grapheneos »

skinfaxi wrote: post #112
StrLght wrote: post #75

Earlier quoted context omitted.

There are valid RASP techniques that involve dynamic code loading, so it actually makes a lot of sense. Source: I worked on RASP a long time ago :) IMO headline is very misleading, and OP should have tried disabling all exploit protection options before jumping to any conclusions. PayPal isn't actively trying to block GrapheneOS as of now.

So to use paypal you actually have to reduce the security of the phone?

In this case, it only reduces the security of the app against exploits rather than the security of the OS. Secure spawning protects the app via unique ASLR bases, random memory tags, etc. Blocking dynamic code loading prevents common accidental vulnerabilities via insecure code loading and hardens against certain exploit techniques.

Re: Tell HN: PayPal blocks GrapheneOS

#307

Post by grapheneos »

codethief wrote: post #251
StrLght wrote: post #53

Still works for me. I had to update exploit protection after their latest update — I think it was enabling dynamic code loading via both memory and storage that did the trick. Edit: checked now, I have also disabled secure app spawning.

Still works for me, too, and I haven't disabled any of Graphene's security features.

Based on user reports, there are recent updates to PayPal requiring disabling the per-app secure spawning toggle. It already required not enabling some of the other protections which are opt-in for user installed apps.

Secure spawning doesn't cause compatibility issues with non-buggy apps (unlike blocking dynamic code loading via memory/storage or native debugging) and apps rarely have issues with it (unlike memory tagging, which finds lots of bugs) so it's on by default.

Re: Tell HN: PayPal blocks GrapheneOS

#308

Post by grapheneos »

dathinab wrote: post #161
shaky-carrousel wrote: post #151

It works here. Running in a work profile, no contactless payments. Play Integrity API: Not blocked Hardened memory allocator: Enabled Memory tagging: Enabled Extended virtual address space: Enabled Secure app spawning: Enabled Native code debugging: Allowed WebView JIT: Disabled Dynamic code loading via memory: Allowed Dynamic code loading via storage: Allowed

> no contactless payments. I think this is the problem here. A lot of NFC related tech is deeply rooted in having "trusted (aka large company)", "attested (aka you can't easily lie)", secure module functionality. What should have happened is to just not enable the contactless payment functionality for given app, even if the user enabled it in general. And not crash. Also as others have pointed out, this might be an a…

The issue turned out to be PayPal adding incorrect anti-tampering code incompatible with our secure app spawning feature. It's common for anti-tampering code to break real security features. It's a major reason for us having the per-app compatibility mode toggle and the finer-grained toggles for the individual exploit protections known to be incompatible with certain apps,

Re: Tell HN: PayPal blocks GrapheneOS

#309

Post by grapheneos »

Groxx wrote: post #194
shaky-carrousel wrote: post #151

It works here. Running in a work profile, no contactless payments. Play Integrity API: Not blocked Hardened memory allocator: Enabled Memory tagging: Enabled Extended virtual address space: Enabled Secure app spawning: Enabled Native code debugging: Allowed WebView JIT: Disabled Dynamic code loading via memory: Allowed Dynamic code loading via storage: Allowed

This is my setup as well, though with JIT enabled (which is the default). Crashing at launch on: version 10.10.0 com.paypal.android.p2pmobile versionCode 1160090162 Seems pretty likely a flawed root detection being rolled out (given the stack trace), my phone is not rooted.

The issue turned out to be PayPal adding incorrect anti-tampering code incompatible with our secure app spawning feature.

Re: Tell HN: PayPal blocks GrapheneOS

#310

Post by grapheneos »

thomasmarton wrote: post #256

I tried it on my Pixel 10 Pro XL as well. Latest version of GrapheneOS, latest play store version of the app and it works. Even tried completely nuking app data and logging in again. Login, security check, fingerprint setup, everything worked (I even got the alert that it used the Play Integrity API) I assume if anything, this is probably the contactless payments. I do somewhat understand why they are really trying t…

The issue turned out to be PayPal adding incorrect anti-tampering code incompatible with our secure app spawning feature.
Post reply on HN