324 total · 178 loaded
Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good guy or a bad guy so it's easier to just ban guns.
It's similar to how people don't like sites blocking entire countries or access from Tor, etc. You might be doing it for privacy...but all the people trying to commit fraud are also using those same channels to hide their identity. The blockades are one piece of a holistic security picture that frustrate the well intentioned users.
Thankfully, PayPal hasn't banned GrapheneOS and their app still works on it. They accidentally broke compatibility with our secure app spawning feature which has a per-app toggle to disable it along with the other exploit protections which can cause compatibility issues.
There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.
A more apt analogy might be game developers who demand admin rights so they can install a rootkit to detect "cheating".
The needs of the user don't matter to them at all.
They have all the data they need, and they choose not to use it.
and if GrapheneOS was a root-having OS.
From a Paypal security POV, weather you use "custom Android OS" or an hugely outdated Android phone, you have:
- a similar risk for the "you" want to mess with Paypal case, in both cases the "you" can technically most likely mess with anything including the "virtual secure module" thingy android uses for NFC
- a lower risk for "others" wanting to mess with Paypal through your phone, at least if "custom Android OS" is GrapheneOS or another up-to-date android fork with decent security handling
so as far as I can tell, this inconsistency is very clearly not about PayPal's security.
IMHO it's about two other things:
1. marketing, if PayPal doesn't work on Android they lose customers, GrapheneOS for now has a tool small customer base for them to care. Outdated Android phone do have a large customer base.
2. compliance/politics BS. including potentially involving insurance. Compliance is mostly about checking of tickmarks(1) on outdated Android they can check them off and blame the user, Goodle or "hackers" for the issue. On GraphemeOS they have a harder time checking it of. Add the smaller user base and end up with PayPal doesn't care. Also iff things go wrong with Paypal on GraphemeOS in a public manner you will have all the "crime os" bad news bs, you won't have that if things go wrong with a even more risky highly outdated Android phone.
-----------------------
I got a bit to much off topic below:
(^1): Technically compliance should be about building robust, secure, law compliant systems and "showing" that by being able to pass a compliance tests consisting about a bunch of requirements. Practically there is way to many ways you can be "fully compliant" (on paper) but not secure and "very secure" but not compliant (wrt. security regulations). In the former case this might still come back and bite you iff you get sued or people suing which should get right don't get it because of ad-absurbum reasoning like "they comply with security regulations, hence can't have acted negligent". It's a shit show I don't know how to fix even if I could just magically change laws as compliance rules need technological flexibility, but if you give them that that will be abused to make insecure things pass. And the whole industry around checking that isn't really one who cares about actual security, sometimes outright corrupt (like groups which have the necessary accredited to check your compliance, are strangely more expensive then other groups, and somehow find less issues in average, with some excuse of why that isn't strange ...) :/
---
Lastly similar to how Teams or Slack could easily support FF (^2) but not only don't but outright refuse to try to even work. PayPal likes to act similar and doesn't care about niches. E.g. at least on some Mobile browsers WebAuthn works, but the PayPal website refuses to _even try_ 2FA with WebAuthn on mobile no matter if the APIs are there or not.
(^2): Yes there are some challenges, AFIK especially in certain edge cases most user might never run into. But Jitsi made it work, other smaller apps also made it work. And Jitsi is open source, so they technically can "look up" all the tricks to make it work (algorithmic ticks, not copy-pasting code) or outright just use their system with an appropriate contract (probably would be even cheaper wrt. maintenance cost then building your own system). At Slack/MS Teams scale that behavior is just messed up.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
The first thing to try when an app doesn't work is trying the per-app exploit protection compatibility mode. That sets all the per-app exploit protection toggles to the compatibility mode. If that works which is likely the problem, it can be narrowed down.
Nearly all Android apps are compatible with GrapheneOS. The exception are around 10% of banking and government apps which use the Play Integrity API to ban using a non-Google-approved device or OS. That's visible to users on GrapheneOS via a Play Integrity API usage notification. After the first use by an app, GrapheneOS provides a menu for blocking using the Play Integrity API which sometimes gets apps working because many don't enforce it working. It's not fully reliable and can have downtime so apps often don't enforce providing a result.
I don't think they care at all about the size of graphene os market share
if its jeopardize entire userbase then its not worth it
"OS that user compiled herself" can avoid this nonsense
No "smallcorp" is safe from Silicon Valley "largecorp" for long with the amounts of money SV largecorp can, and will, offer smallcorp if smallcorp grows. SillyCon Valley "largecorp" wants data about/from users, not users' money
"Safe way to make sure I'll stop being your customer - also YES!"
The user is not SV largecorp's customer
That would make a great blog post
Mistakes happen and ya can't fix what you don't know about. Always report issues.
Also strongly consider just using the website.
I had to update exploit protection after their latest update — I think it was enabling dynamic code loading via both memory and storage that did the trick.
Edit: checked now, I have also disabled secure app spawning.
(Rather than something fundamentally incompatible, like them using Play Integrity)
IMO headline is very misleading, and OP should have tried disabling all exploit protection options before jumping to any conclusions. PayPal isn't actively trying to block GrapheneOS as of now.
Secure spawning doesn't cause compatibility issues with non-buggy apps (unlike blocking dynamic code loading via memory/storage or native debugging) and apps rarely have issues with it (unlike memory tagging, which finds lots of bugs) so it's on by default.
Play Integrity API: Not blocked
Hardened memory allocator: Enabled
Memory tagging: Enabled
Extended virtual address space: Enabled
Secure app spawning: Enabled
Native code debugging: Allowed
WebView JIT: Disabled
Dynamic code loading via memory: Allowed
Dynamic code loading via storage: Allowed
I think this is the problem here.
A lot of NFC related tech is deeply rooted in having "trusted (aka large company)", "attested (aka you can't easily lie)", secure module functionality.
What should have happened is to just not enable the contactless payment functionality for given app, even if the user enabled it in general. And not crash.
Also as others have pointed out, this might be an accidental mishap not an intended outcome.
But it's not like PayPal is known to care about small user-base edge cases (quite the opposite). Which I guess is the actual root problem.
Version 8.107.0
com.paypal.android.p2pmobile
version 10.10.0
com.paypal.android.p2pmobile
versionCode 1160090162
PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.
I've read once that there are paid app testing labs which test if an app has root and custom ROM detection and when they don't have that it's a minus point on the report.
We have per-app toggles for exploit protections known to have compatibility issues. Secure spawning wasn't expected to cause any compatibility issues so we didn't have a per-app toggle for it until recently but it's available now.
Hanlon's Razor is a useful tool. https://en.wikipedia.org/wiki/Hanlon%27s_razor
Several of the more aggressive exploit protections are enabled for the base OS but are opt-in for user-installed apps. Memory tagging should work with all user installed apps but is opt-in because it's so good at detecting invalid memory accesses and uncovers a lot of bugs. Dynamic code loading via storage, dynamic code loading via memory and native debugging are allowed by default since a significant fraction of apps need those and it's not usually a bug. Users can set those as enabled by default for user installed apps which is particularly recommended for memory tagging but then people need to deal with the incompatibilities. The defaults don't cause issues with most apps so not everyone is aware of the per-app toggles.
This is evil in itself.
Even tried completely nuking app data and logging in again. Login, security check, fingerprint setup, everything worked (I even got the alert that it used the Play Integrity API)
I assume if anything, this is probably the contactless payments. I do somewhat understand why they are really trying to lock something like this down, but as everyone pointed out, giving the green light to a CVE infested version of Android while prohibiting the use of a version that goes above and beyond when it comes to security is absurd.
There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.
So, best to grow the user base fast now and let every user send a complaint for every app that gets blocked. A few million users will be harder to ignore.
I also get why they'd be desperate to fight bots. It's a weak excuse for not doing it better, but at least it makes some sense.
https://arstechnica.com/gadgets/2026/08/motorolas-grapheneos...
Have you tried the per-app exploit protection compatibility mode or the finer-grained toggles for those apps? 90% of banking apps work on GrapheneOS but MANY have problematic anti-tampering code requiring the per-app compatibility mode.
But GrapheneOS isn't root, that's just PayPal's thing being broken.
If they want to ban arbitrary operating systems, they can use attestation and it can't be fooled the way you're describing. Apps doing this can explicitly verify GrapheneOS and we've convinced some apps to do that. We've also convinced a smaller number to stop doing that at all.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
Starling Bank app still works on GrapheneOS too. See here:
https://github.com/PrivSec-dev/banking-apps-compat-report/is...
Funnily enough, the only way to hide those detections was to Root my phone... And i still remember when i had an appointment there, they wanted to see something in my Bank app, i opened it (and i assume it had an update since i then last used it) and a big "THIS DEVICE IS NOT SUPPORTED. ROOT IS NOT SUPPORTED" poped up
But was as simple as readding the bank app to my root hiders.
but still, i hate this security theater
GrapheneOS officially passes only the MEETS_BASIC_INTEGRITY tier of the Google Play Integrity API and fails the MEETS_DEVICE_INTEGRITY and MEETS_STRONG_INTEGRITY levels.
Many banking apps I use in my country require this level plus something from the GPI API, which makes them unusable. You need a regular, unmodified smartphone to use them.
Tap-to-pay is unlikely to be provided via their website and does work on GrapheneOS.
I use latest Aurora Store PayPal version and it still works. I just dont use contactless payment.
There's some countries with very bad financial sector where your option is PayPal or Western Union as the local banks don't know how to do international transfers, Remitly doesn't support all countries and Wise also doesn't work. PayPal works, even if they charge fees.
One of the ladies at daycare is leaving? Here's a paypal link to chip in for a good-bye present.
Split a take-out order with a German friend, but he paid? Here's his paypal to send him your share.
It's just assumed that everyone has paypal over here...
PayPal's app does still work on GrapheneOS, they only accidentally broke it with the default settings due to bugs in their anti-tampering code. Disabling the per-app exploit protection compatibility mode works around it. They should fix it and start testing on GrapheneOS.
It may also require dynamic code loading via storage, dynamic code loading via memory and native debugging being permitted but those aren't blocked for user installed apps by default. People can opt-in to those being enabled by default for user installed apps similarly to memory tagging, but memory tagging has the biggest positive impact.
You may also not have the update yet. Play Store supports staged rollouts where updates are only available to a set percentage of users.
You may also not have the update yet. Play Store supports staged rollouts where updates are only available to a set percentage of users.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
GrapheneOS is an operating system rather than read-only memory firmware. There's a ROM in early boot (boot ROM) which loads the SoC boot firmware from the SSD which loads other SoC firmware from the SSD and then loads the OS from the SSD.
Their app can also still be used on GrapheneOS. It just requires the per-app secure spawning toggle due to a recently added app bug.
The vast majority of Android apps including PayPal work fine on GrapheneOS.
PayPal recently shipped incorrect anti-tampering code incompatible with our secure spawning feature. The feature spawns app processes with exec to provide their own address space layout randomization, random memory tags and canaries. We're aware of these kinds of incompatibilities and provide a per-app toggle for exec-based spawning which works for PayPal. PayPal made a mistake and didn't consider GrapheneOS as part of this recent change. They'll likely fix it since they don't ban using GrapheneOS and likely want it working on GrapheneOS.
The OS is designed to offer privacy and security guarantees, which root access breaks, so they don't offer it.
Because your argument sounds like you gave the admin password to someone else to prevent yourself from tampering with your computer for the security reasons
GrapheneOS has never received or applied for any government grants. It doesn't have any involvement with any governments. GrapheneOS is banned by the Play Integrity API device and strong integrity levels. In practice, the only app compatibility issues which can't be worked around with our compatibility issues are apps adopting the Play Integrity API to enforce those.