Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: PayPal blocks GrapheneOS

news.ycombinator.com

Post reply on HN
Print view View original

311–320 of 361 posts

Re: Tell HN: PayPal blocks GrapheneOS

#311

Post by grapheneos »

gnoll_of_gozag wrote: post #18

Can it still run in browser like it would on a regular pc?

Yes, but the app still works on GrapheneOS. They accidentally broke compatibility with the default settings with incorrect anti-tampering code. Disabling the per-app toggle for secure spawning works around it.

We have per-app toggles for exploit protections known to have compatibility issues. Secure spawning wasn't expected to cause any compatibility issues so we didn't have a per-app toggle for it until recently but it's available now.

Re: Tell HN: PayPal blocks GrapheneOS

#312

Post by grapheneos »

qingcharles wrote: post #185
gnoll_of_gozag wrote: post #18

Can it still run in browser like it would on a regular pc?

Yes, but you might have to enable desktop mode on a mobile browser so it doesn't try force-spawning the app.

The app still works too. PayPal just accidentally broke compatibility with secure spawning which can be toggled off per-app. We didn't used to have a per-app toggle since it wasn't expected to cause compatibility issues and it was non-trivial to add support for it, but we have it now.

Re: Tell HN: PayPal blocks GrapheneOS

#313

Post by grapheneos »

onion2k wrote: post #31

Has PayPal blocked GrapheneOS, or have they blocked every OS they're unable to verify and done a poor job of implementing their checks? Hanlon's Razor is a useful tool. https://en.wikipedia.org/wiki/Hanlon%27s_razor

PayPal accidentally broke support for GrapheneOS with the default settings for the app by adding incorrect anti-tampering code. It can be worked around using the per-app toggle to disable secure spawning. It shouldn't be necessary and we didn't expect there to be apps incompatible with secure spawning so we didn't originally design it to have a per-app toggle and had to add it.

Several of the more aggressive exploit protections are enabled for the base OS but are opt-in for user-installed apps. Memory tagging should work with all user installed apps but is opt-in because it's so good at detecting invalid memory accesses and uncovers a lot of bugs. Dynamic code loading via storage, dynamic code loading via memory and native debugging are allowed by default since a significant fraction of apps need those and it's not usually a bug. Users can set those as enabled by default for user installed apps which is particularly recommended for memory tagging but then people need to deal with the incompatibilities. The defaults don't cause issues with most apps so not everyone is aware of the per-app toggles.

Re: Tell HN: PayPal blocks GrapheneOS

#314

Post by grapheneos »

glitchc wrote: post #200
fylo wrote: post #74

Earlier quoted context omitted.

Graphene isn't rooted....

We don't know if the OP has rooted their phone in addition to installing Graphene.

If they replaced the core of the OS with a rootkit, it wouldn't be GrapheneOS anymore but rather a derivative of it. They didn't do that and people should be clear if they have rather than calling it GrapheneOS.

Re: Tell HN: PayPal blocks GrapheneOS

#315

Post by grapheneos »

prartichoke wrote: post #86

Confirmed on my phone too. I left a 1-star review on the play store saying it crashes on every launch, uninstalled and will use the website from now on. (Luckily, I dont use contactless payments, ai just send and receive money from friends from time to time)

You can solve it with the per-app toggle for disabling secure spawning. PayPal only accidentally broke compatibility with secure spawning. You should still complain to them about it.

Re: Tell HN: PayPal blocks GrapheneOS

#316

Post by grapheneos »

bit1993 wrote: post #24

I was always suspicious of GrapheneOS, thought it was too good to be true. But this makes me reconsider and want to install GrapheneOS.

Thankfully, PayPal hasn't banned GrapheneOS and their app still works on it. They accidentally broke compatibility with our secure app spawning feature which has a per-app toggle to disable it along with the other exploit protections which can cause compatibility issues.

There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.

Re: Tell HN: PayPal blocks GrapheneOS

#317

Post by grapheneos »

bdzr wrote: post #55

I also ran into the eBay application being blocked just recently. Other than that I've had no issues, but I imagine this is going to become more and more common as time goes on.

PayPal's app still works with the per-app secure spawning toggle disabling for it.

Re: Tell HN: PayPal blocks GrapheneOS

#318

Post by grapheneos »

sdcfgy wrote: post #20

I'm starting to see these restrictions as a deterrent for using the products in question. My GOS handset is slowly fizzling away into a dumbphone with Firefox, organic maps and k9. And you know what, I am starting like it.

The vast majority of Android apps work on GrapheneOS. App compatibility is not diminishing in any significant way. We've improved app compatibility faster than Play Integrity API adoption has happen, which this isn't.

PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.

Re: Tell HN: PayPal blocks GrapheneOS

#319

Post by grapheneos »

anonymousiam wrote: post #54

Hopefully these stupid companies that are refusing to allow their apps to run on GrapheneOS will have a change of heart when Motorola begins launching their new phones: https://arstechnica.com/gadgets/2026/08/motorolas-grapheneos...

PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.

Re: Tell HN: PayPal blocks GrapheneOS

#320

Post by grapheneos »

savwolf wrote: post #43

This is what really makes me question if I want to continue to use GOS, already some UK banks apps (which are app only) don't want to run. I'm considering switching back to stock as I can't be bothered to try to find hacks and workarounds for daily necessities.

PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.

Have you tried the per-app exploit protection compatibility mode or the finer-grained toggles for those apps? 90% of banking apps work on GrapheneOS but MANY have problematic anti-tampering code requiring the per-app compatibility mode.

Post reply on HN