HN Explorer

Tell HN: PayPal Blocks GrapheneOS

1 points by leumon ↗ HN
It seems like the PayPal app now refuses to run on GrapheneOS. I don't know if it's only because I have enabled the PayPal card for contacless NFC payments, but when opening the app it crashes with the following exception: com.paypal.oslo.app.rasp.RootDetectionSecurityException: Security policy violation: s=root

279 comments

[ 0.23 ms ] story [ 18.1 ms ] thread
freakynit
"RootDetectionSecurityException" .. there's your answer ... it doesnt't want to run on "rooted" devices.
[deleted]
(comment deleted)
windowliker
Isn't it more likely to be saying that the app is running with root privileges?
tensegrist
iirc grapheneos can't be rooted unless you do your own build
futune
That's the bizarre thing about this hn discussion... A lot of people referencing rooted phones, but to the best of my knowledge GrapheneOS is almost never rooted?
grapheneos
There's only root if people make a userdebug build with user-accessible root or make a derivative of GrapheneOS with major modifications. The production builds don't have uncontained root since it would greatly roll back the security model. Only a few core processes run as a limited subset of root.
Sophira
It can be rooted just fine without doing your own build. It's just that if you do, the GrapheneOS community will claim that it is no longer GrapheneOS and that it's separate.
grapheneos
Replacing a large portion of the core operating system code and SELinux policies with a third party project is making a derivative of the OS. It can no longer receive standard updates anymore and won't pass verified boot without resigning it. A derivative of GrapheneOS with significantly different code, SELinux policies and distinct signing keys is not GrapheneOS. Verified boot will no longer work as intended anymore even after resigning and the same applies to a large portion of the security model in the OS. Giving root to a huge portion of the OS greatly reduces security even if it's never granted to any apps.
grapheneos
There's only root if people make a userdebug build with user-accessible root or make a derivative of GrapheneOS with major modifications. The production builds don't have uncontained root since it would greatly roll back the security model. Only a few core processes run as a limited subset of root.
grapheneos
GrapheneOS isn't rooted. PayPal works on GrapheneOS and doesn't try to ban using it. However, they recently shipped incorrect anti-tampering code incompatible with our secure app spawning feature (exec-based app process spawning). It can be worked around by disabling the per-app secure spawning toggle for PayPal. For simplicity, there's a per-app exploit protection compatibility mode toggle which sets all the finer grained exploit protection toggles to the compatibility mode.

GrapheneOS is an operating system rather than read-only memory firmware. There's a ROM in early boot (boot ROM) which loads the SoC boot firmware from the SSD which loads other SoC firmware from the SSD and then loads the OS from the SSD.

gib444
With or without Google Play Services running?
grapheneos
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
leumon
Update: it seems to work when disabling "secure app spawning" (for now)
zvmaz
So it's not PayPal blocking GrapheneOS?
zem
sounds more like grapheneos blocking paypal!
grapheneos
No, they added incorrect anti-tampering code. It's wrongly detecting secure app spawning giving each app their own address space, memory tags, etc. via exec as tampering.
aabdelhafez
Switched to Wero and haven't looked back.

https://wero-wallet.eu

oniony
The website is pages and pages of blankness for me on Firefox mobile.
unpopularopp
Unfortunately peasants like us who don't live in the 5 countries where it's available still can't look back
Carbon1603
I live where it's available and still can't use it to pay stuff, only to transfer money to friends.
therealmarv
wait for it... I can see a future were every wallet, payment etc. app will block devices which are on custom ROMs and do not pass strong hardware integrity with blessing from Google.

I've read once that there are paid app testing labs which test if an app has root and custom ROM detection and when they don't have that it's a minus point on the report.

muvlon
You need to use your bank's app for Wero, and many EU banks' apps refuse to run on GrapheneOS for the same reasons as PayPal. This is sadly not a clear win for Wero.
savwolf
Does this work in the UK?
doublerabbit
No. We left the EU, so we don't get such fun.
jeroenhd
Wero also isn't implemented EU-wide either, so it's still possible as long as the banks play ball.

UK politics has been quite isolationist, though, so I doubt the banks will see much in interoperating with the rest of Europe.

sunaookami
Wero is not a PayPal alternative. It doesn't even have buyer's protection and every bank must manually implement it which immediately makes it a failure. Some banks also connect it to your phone number so you can't link Wero to two different bank accounts with the same number when you have 2 bank accounts. Very messy.
master-lincoln
> Some banks also connect it to your phone number

What do you mean "some banks"? I thought the whole value proposition of Wero was instant bank transfers with SEPA but using phone numbers?

[dead] jeroenhd
[dead]
Aachen
FYI this comment was dead, not flagged. I wonder if you're hellbanned or if it was a keyword trigger
sunaookami
...why would I give my phone number to random people to pay them? I'd rather use an email address or user name. And using phone numbers means making it easier for normal people which means uploading the whole address book to the bank... just no.
Aachen
I'd rather give the bank account number to people that need to send money there. Why bother with email address?
sunaookami
With the number everyone can withdraw money (which is two clicks to cancel the transfer but still annoying).
Carbon1603
Sadly, not even close. I would even dare to say that Klarna is closer to what PayPal is, than Wero.
zerof1l
I see this happen from time to time. Lately, almost all of the apps work fine on GrapheneOS. The best strategy is to keep writing the business once every two or so weeks that you can’t log in to and use the app. Don’t go too technical at first, because most of the time, the moment they hear things like “rooted” or “unofficial,” they just say your phone is the issue. To date, I was able to convince, or at least contribute to, making three apps work on GOS.
basilikum
Great job, man. We have to make ourselves get heard. It's a social problem after all. Technical workarounds are great and sometimes the only practical short term option, but we have to fix the social issue at the root.
dvoros
I had the same experience. Asked in an email why an important government app won't work on GrapheneOS, first without any technical details. Got the response that it's "because security". I sent some technical details and argued that they're denying service to their most security-conscious users. 3 months later the app started to work!
dinfinity
To be fair, governments might be much more receptive to the argument of not having to rely on (possibly foreign) megacorporations than a company like Paypal.

I'd wager that if it doesn't really hurt their bottom line to not support GrapheneOS, they won't really care.

microtonal
I think in this case it's also them just introducing a new check that either GrapheneOS will need to work around or Paypal needs to refine. I can reproduce the issue, but it doesn't seem like it did a failed Play Integrity check at that point.
Groxx
Honestly there's a decent chance they don't even know, in most cases, because corporate environments generally try hard to have as few as possible hardware/software setups to maintain. And they're unlikely to proactively test on Graphene unless it's closely related to what they do (and it definitely is not for most apps).

Mistakes happen and ya can't fix what you don't know about. Always report issues.

Also strongly consider just using the website.

lta
Would you mind elaborating a bit on your process ? Or share a few relevant exchanges, I've no clue how to start having this discussion.

That would make a great blog post

cromka
My backwards bank blocked my mobile app access after detecting Debugging was enabled in the system. Have to call them to unlock it. I could download that APK and disassembly it with an LLM in 20 minutes, but sure, a Debug mode prevents something.
downrightmike
Which is the opposite reaction for PC problems, because people actually have choice and historically don't accept malware being the default
hd4
did you re-lock the bootloader?
grapheneos
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
axegon_
This is arguably the most irritating thing with just about every largecorp developer: "os that hasn't been updated in 6 years? Sure boss!". Os that is built specifically around security and privacy with daily updates: "No, you can't do that". Annoying - yes. Safe way to make sure I will stop being your customer - also YES!
fluidcruft
Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors).

Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good guy or a bad guy so it's easier to just ban guns.

axegon_
That's your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don't have to legally be adult to buy any of the things you'd need and I say that as someone who only struggled with chemistry in school, that's now low the bar is. What's the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronomically lower than any Chinese spyware-infested phone.
john_strinlai
physical risks, like your example, do not map well to digital risks faced by large international companies.
axegon_
It was a response to the gun example which is a physical risk. My argument is that Paypal (much like all other tech-bro companies) are incompetent. The incompetence grows exponentially the larger a software company is. I speak of experience.

On a side note, if you want to be extremely specific, the line between the physical and digital threat does not exist anymore. There are two things people need to be afraid of: incompetent friends and competent enemies. Tech giants are already filled to the brim with incompetent friends, which drastically lowers the bar for the competence of their enemies.

pkulak
It was an analogy, or metaphor, I forget the distinction. But I don't think it was stood up to be literally argued against though.
rc5150
then it was a bad analogy.
HenriTEL
The problem here seems to be that the phone is detected as rooted, not specifically that it's running grapheneOS. But I agree that it's a big problem. That's how you end up in a situation where google has full control from hardware to final apps like on iphones. When devs assume that everybody is using the stock android with google services enabled.
Melatonic
You'd think they're would be a way to switch Graphene to non root privilege mode
nulld3v
Graphene takes a strict anti-rooting stance and adds security measures that (unintentionally) hinder rooting.

Most rooting methods do not work on GrapheneOS without additional modifications.

grapheneos
It does not have a root privilege mode. GrapheneOS doesn't weaken any aspect of the standard security model. It has all of the standard security model and features including hardware-based security intact. It greatly improves security rather than doing that.

User accessible root access is available in userdebug (non-production) builds. There's no system for granting root access to apps. It's no different from the stock OS in this regard, but it's a lot more secure than the stock OS.

svpk
GrapheneOS is not rooted. The phone not being rooted is part of the GrapheneOS' security model.

I assume the issue is it failing the deeper play integrity check which is about it not being "Google approved."

grapheneos
It isn't due to the Play Integrity API. That shows a notification on GrapheneOS with a toggle for blocking it to work around it for services not enforcing providing a result. If that was the issue, the original poster would have known from the notification. The issue ended up being PayPal shipping incorrect anti-tampering code incompatible with secure spawning. The original poster figured that out and got it working by disabling the per-app secure spawning toggle.
ryandrake
How did we let "rooting" become some evil thing?

It's normal to have root (or Administrator) on your devices. After all, they are yours. They don't belong to the device manufacturer. You should have full access to your own devices by default.

Only recently did we somehow normalize the idea that the user should not be the ultimate decider over their own devices.

6510
We've already progressed from "the user should not be" to "the user should never be". Perhaps we will even grow out of calling it "their own devices" eventually. If they can brick it remotely it kinda already isn't really yours?
iugtmkbdfil834
Parent has a point by playing devil's advocate. Practical considerations indicate that platform is gonna platform. Solution here to greed driven development is some level of 'non possumus' from the general public. Sadly, I am starting to think is what we really need is a lot of valve like companies, where company stay private, founder is not a complete asshole and so on. Tall order, but that is the only real way to reverse some of the damage. I am done counting on the public to see light.
robocat
Do you like science?

I propose you buy enough ingredients from the supermarket and make a big batch.

The scientific test is: how far do you get, before your door is kicked in?

If that fails, then science #2: have fun lighting it!!

You almost win both ways. (although I admit I wouldn't fund you even via a trustworthy intermediary say a Kickstarter campaign.

yonatan8070
Their problem is that stock Android doesn't allow the user to muck around with the insides of apps, and will make it harder for you to trick the PayPal app, while a custom ROM gives you full control to do unfriendly things to the app like reverse-engineering, inspecting it at runtime, and messing around with its internal state.
brightball
Yea, years ago I was in the security space and got to talk to some paypal security folks at a symposium in San Diego. The level of stuff that they have to deal with is so extreme.

It's similar to how people don't like sites blocking entire countries or access from Tor, etc. You might be doing it for privacy...but all the people trying to commit fraud are also using those same channels to hide their identity. The blockades are one piece of a holistic security picture that frustrate the well intentioned users.

axegon_
Yet another weak point. My question stands: A user with an OS from 2019 is "secure" and dozens of unpatched CVEs but a literally-last-night-patch OS is not? That's the "stuff they have to deal with"? I was lucky and did not make the mistake of joining a payment provider in 2020 or 2021 (I can't remember). The reality is that European laws are much harsher when it comes to payments and personal data protection and the security team I was being interviewed for was catastrophic(big part of the reason I did the "I accepted another offer already, sorry" card).

As for geo fencing or blocking Tor... HAH! As if that's ever stopped anyone with the will. That is the last concern of anyone with a malicious intent. Sure, it stops irritating kids but no one beyond that.

The simple fact is that cybersecurity was in an abysmal state before the slopification began and it's infinitely worse now. Paypal is no different given that much of their support has been outsourced to slop machines. Punishing the users that know what they are doing while rewarding the ones that don't is the most counter-productive and detrimental crap anyone could come up with.

browningstreet
> That's the "stuff they have to deal with"?

No. It's the offensive fraud vector coming from unsecured devices that account for a significant portion of the noise. Requiring device profiling aggravates this vector.

axegon_
> unsecured devices that account for a significant portion of the noise. Requiring device profiling aggravates this vector.

Bullshit! Source:

> The reality is that European laws are much harsher when it comes to payments and personal data protection and the security team I was being interviewed for was catastrophic

Sounds like someone who wanted to impress the audience with fluffed up claims.

Zedfragg
It's comments like yours that remind me of an important lesson.

Just because you argue with vigor and intent, it doesn't make you right.

People are offering their opinions, try not being a dick about it.

GrapheneOS is a privacy orientated OS which is great. But if the vectors to achieve privacy are the same as used by bad actors, I'd block it too.

Get over it, don't like it? Use a different product. Or make a better one.

brightball
I don't run their business. Just trying to explain.

From what we see above it sounds like the change trips their rootkit detection, which they are probably interpreting as a compromised device.

It sounds like you're expecting them to have a perfect security posture that can correctly identify fraud in call cases and only block the real thing. It's more complicated than that and there's typically some type of scoring system involved with numerous triggers that are higher value indicators of potential fraud. If they think the device is compromised, that's probably a high value indicator.

This is just me speculating.

a2ff6eeb0
Yeah, they can track and profile the old os, and feed the data to the risk models.

It's not about user security.

xelxebar
This is interesting. You're gesturing at the idea that individual security practices can be at odds with those needed for group security. I'll be pondering on this.
brightball
Yep. If a security team sees 96% of credit card fraud is coming from users on Tor they are more likely to just block Tor than they are to try to figure out how to safely let the other 4% keep using it.
dmichulke
To stay with your analogy, there is no technical obstacle to treating the customer of 15 years differently compared to the newly onboarded one.

They have all the data they need, and they choose not to use it.

dathinab
this isn't quite true

From a Paypal security POV, weather you use "custom Android OS" or an hugely outdated Android phone, you have:

- a similar risk for the "you" want to mess with Paypal case, in both cases the "you" can technically most likely mess with anything including the "virtual secure module" thingy android uses for NFC

- a lower risk for "others" wanting to mess with Paypal through your phone, at least if "custom Android OS" is GrapheneOS or another up-to-date android fork with decent security handling

so as far as I can tell, this inconsistency is very clearly not about PayPal's security.

IMHO it's about two other things:

1. marketing, if PayPal doesn't work on Android they lose customers, GrapheneOS for now has a tool small customer base for them to care. Outdated Android phone do have a large customer base.

2. compliance/politics BS. including potentially involving insurance. Compliance is mostly about checking of tickmarks(1) on outdated Android they can check them off and blame the user, Goodle or "hackers" for the issue. On GraphemeOS they have a harder time checking it of. Add the smaller user base and end up with PayPal doesn't care. Also iff things go wrong with Paypal on GraphemeOS in a public manner you will have all the "crime os" bad news bs, you won't have that if things go wrong with a even more risky highly outdated Android phone.

-----------------------

I got a bit to much off topic below:

(^1): Technically compliance should be about building robust, secure, law compliant systems and "showing" that by being able to pass a compliance tests consisting about a bunch of requirements. Practically there is way to many ways you can be "fully compliant" (on paper) but not secure and "very secure" but not compliant (wrt. security regulations). In the former case this might still come back and bite you iff you get sued or people suing which should get right don't get it because of ad-absurbum reasoning like "they comply with security regulations, hence can't have acted negligent". It's a shit show I don't know how to fix even if I could just magically change laws as compliance rules need technological flexibility, but if you give them that that will be abused to make insecure things pass. And the whole industry around checking that isn't really one who cares about actual security, sometimes outright corrupt (like groups which have the necessary accredited to check your compliance, are strangely more expensive then other groups, and somehow find less issues in average, with some excuse of why that isn't strange ...) :/

---

Lastly similar to how Teams or Slack could easily support FF (^2) but not only don't but outright refuse to try to even work. PayPal likes to act similar and doesn't care about niches. E.g. at least on some Mobile browsers WebAuthn works, but the PayPal website refuses to _even try_ 2FA with WebAuthn on mobile no matter if the APIs are there or not.

(^2): Yes there are some challenges, AFIK especially in certain edge cases most user might never run into. But Jitsi made it work, other smaller apps also made it work. And Jitsi is open source, so they technically can "look up" all the tricks to make it work (algorithmic ticks, not copy-pasting code) or outright just use their system with an appropriate contract (probably would be even cheaper wrt. maintenance cost then building your own system). At Slack/MS Teams scale that behavior is just messed up.

kevin_thibedeau
The cherry on top is that their web site invariably still works so the refusal to work via app is an intentional manipulation tactic to harvest more consumer data for sale.
gvurrdon
Sadly, their website now appears to require an app in order to sign in. Even before that it would often block me with text along the lines of "We don't know who you are, call our support number."
kevin_thibedeau
Desktop mode fixes discrimination against small viewports.
gvurrdon
This was happening to me on the desktop. I've not tried on a phone (I try to avoid PayPal).
HeyLaughingBoy
PayPal? I sign in all the time. If you're referring to the popup to add a new authentication method, you can just escape past it.
fluidcruft
I'm fairly skeptical the website supports NFC payments.
RunSet
> Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies.

A more apt analogy might be game developers who demand admin rights so they can install a rootkit to detect "cheating".

BobaFloutist
They wouldn't do that if there weren't market demand. Competitive games lose their appeal when cheating becomes too prevalent.

Similarly, payment processors lose their appeal if they can't prevent people stealing your money, or spending stolen money on your products.

akimbostrawman
Paypal's security? the same "security" which in 2026 still does no allow a passwords above 32 character (which most likely indicating that they don't hash passwords)?
DANmode
This might make sense if you trusted clients,

and if GrapheneOS was a root-having OS.

wolvoleo
I think the issue is more that big tech only trusts their own kind and usually has motives to exclude privacy conscious software because they can't datamine it or make backroom exclusivity deals.

The needs of the user don't matter to them at all.

grapheneos
There's no tension between the security of PayPal against bad actors and support for GrapheneOS. GrapheneOS preserves the whole standard security model and greatly improves security. It's far more secure than anything permitted by the Play Integrity API device or strong integrity levels.

Thankfully, PayPal hasn't banned GrapheneOS and still works on it. They accidentally broke compatibility with our secure app spawning feature which has a per-app toggle to disable it along with the other exploit protections which can cause compatibility issues. There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.

tonyhart7
"Safe way to make sure I will stop being your customer - also YES!"

I don't think they care at all about the size of graphene os market share

if its jeopardize entire userbase then its not worth it

axegon_
Fine by me. My example illustrates their incompetence if they are willing to let a user with an OS that hasn't received any updates in half a decade, then clearly, they don't give a single crap about security.
dylan604
I'm sure their automatic bans have happened to more people than the number of grapheneOS users
ravenstine
With the way today's economy works, they probably wouldn't even care if they lost 1/4 of their customers in just one year. Maybe their share price would jump!
matheusmoreira
It was never about your security, it was about the corporation's security from you!
xnx
Might be more a matter of "OS with millions of users" vs. "OS with dozens of users".
RobotToaster
It's not about protecting your security, it's about protecting the "security" of corporate profits.
exe34
The safety isn't for you, it's for the companies who want your data without you getting in the way.
1vuio0pswjnm7
With Silicon Valley "largecorp" the required "security" is to protect the company from (a) the privacy-conscious user who would object to the company's data collection, surveilllance or ads/tracking and (b) from competitors, i.e., other companies that would potentially do data collection, surveillance, advertising services if they had uncontrolled access to largecorp's users

"OS that user compiled herself" can avoid this nonsense

No "smallcorp" is safe from Silicon Valley "largecorp" for long with the amounts of money SV largecorp can, and will, offer smallcorp if smallcorp grows. SillyCon Valley "largecorp" wants data about/from users, not users' money

"Safe way to make sure I'll stop being your customer - also YES!"

The user is not SV largecorp's customer

fmajid
Revolut pulled that stunt, I cancelled my account with them.
axegon_
This one is pretty interesting. I was ready to cancel my account on the spot when the news popped up but it still works on my phone. And I've updated the app as many times as they've made a release since the announcement. I honestly haven't got a clue what is going on with them.
grapheneos
PayPal app still works on GrapheneOS.

It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.

The first thing to try when an app doesn't work is trying the per-app exploit protection compatibility mode. That sets all the per-app exploit protection toggles to the compatibility mode. If that works which is likely the problem, it can be narrowed down.

Nearly all Android apps are compatible with GrapheneOS. The exception are around 10% of banking and government apps which use the Play Integrity API to ban using a non-Google-approved device or OS. That's visible to users on GrapheneOS via a Play Integrity API usage notification. After the first use by an app, GrapheneOS provides a menu for blocking using the Play Integrity API which sometimes gets apps working because many don't enforce it working. It's not fully reliable and can have downtime so apps often don't enforce providing a result.

factorialboy
The largeCorp developer and their PM are many orgs and layers away from where these decisions are mandated.
gnoll_of_gozag
Can it still run in browser like it would on a regular pc?
qingcharles
Yes, but you might have to enable desktop mode on a mobile browser so it doesn't try force-spawning the app.
grapheneos
The app still works too. PayPal just accidentally broke compatibility with secure spawning which can be toggled off per-app. We didn't used to have a per-app toggle since it wasn't expected to cause compatibility issues and it was non-trivial to add support for it, but we have it now.
Itoldmyselfso
You can change the link handling in the app settings so it doesn't try to open it via the app. Or open the site in incognito window.
Aachen
I wish it ran in my browser on my pc
grapheneos
Yes, but the app still works on GrapheneOS. They accidentally broke compatibility with the default settings with incorrect anti-tampering code. Disabling the per-app toggle for secure spawning works around it.

We have per-app toggles for exploit protections known to have compatibility issues. Secure spawning wasn't expected to cause any compatibility issues so we didn't have a per-app toggle for it until recently but it's available now.

sdcfgy
I'm starting to see these restrictions as a deterrent for using the products in question. My GOS handset is slowly fizzling away into a dumbphone with Firefox, organic maps and k9. And you know what, I am starting like it.
grapheneos
The vast majority of Android apps work on GrapheneOS. App compatibility is not diminishing in any significant way. We've improved app compatibility faster than Play Integrity API adoption has happen, which this isn't.

PayPal's app still works with the per-app secure spawning toggle disabling for it. It's a bug in very recent versions of the PayPal app.

bit1993
I was always suspicious of GrapheneOS, thought it was too good to be true. But this makes me reconsider and want to install GrapheneOS.
kissiel
I think if paypal not working on GOS makes you not use it, then GOS is definitely not for you...
nicman23
it is great and you know that because cops are pissy about it
grapheneos
Thankfully, PayPal hasn't banned GrapheneOS and their app still works on it. They accidentally broke compatibility with our secure app spawning feature which has a per-app toggle to disable it along with the other exploit protections which can cause compatibility issues.

There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.

nunobrito
Paypal doesn't work on LineageOS since a long time, even though the connections of that dubious Graphene distro with the US government are always in the horizon it is just natural that paypal doesn't work there now.

Otherwise it would just continue to raise suspicious that Graphene is favored by governments and big tech.

imska
It does work for me on lineages for microg with an Xperia 5 II. Haven't tried to activate contactless though.
nunobrito
Never worked for me, tried with microg and plenty of other ways.
grapheneos
PayPal works fine on GrapheneOS too. They recently shipped an update with incorrect anti-tampering code incompatible with our secure spawning feature. It can be worked around by toggling off secure spawning as the creator of this thread figured out on their own. For ease of use, we have a simple per-app exploit protection compatibility mode setting all these features to a compatibility mode instead of people needing to figure it out.
grapheneos
PayPal works well on GrapheneOS. PayPal shipped incorrect anti-tampering code wrongly detecting our secure spawning feature as tampering. It works fine when the per-app toggle for secure spawning is disabled. These incompatibilities with hardening features are relatively common in banking apps. We provide an overall exploit protection compatibility mode toggle for ease of use rather than people needing to figure out which feature is incompatible.

GrapheneOS has never received or applied for any government grants. It doesn't have any involvement with any governments. GrapheneOS is banned by the Play Integrity API device and strong integrity levels. In practice, the only app compatibility issues which can't be worked around with our compatibility issues are apps adopting the Play Integrity API to enforce those.

tombardier
Still works on my up to date pixel 9 xl. I haven't enabled NFC payments though
grapheneos
Their recent updates require disabling secure spawning via the per-app toggle, that's all. NFC payments still work.
Kwpolska
Why would anyone still use PayPal after so many cases of accounts being banned and funds being frozen for no reason, and all the other terrible stuff they've done?
[deleted]
(comment deleted)
rciorba
Critical mass? I had to start using it after moving to Germany, because everyone else expects you to use it.

One of the ladies at daycare is leaving? Here's a paypal link to chip in for a good-bye present.

Split a take-out order with a German friend, but he paid? Here's his paypal to send him your share.

It's just assumed that everyone has paypal over here...

cloudie78
Time to start heralding change you want to see. Offer Wero instead. It’s really simple.
OroPla
As a German that never has encountered PayPal in the wild and doesn't have a Paypal account either, your narration requires elaboration to be believable. I've been to big cities and small townships and it wouldn't surprise me if most Germans wouldn't even know what PayPal is.
dewey
I'm not doubting you but I have a hard time believing that, as I see it all the time. Sometimes restaurants even accept it if they don't take card and then ask you to send to their private PayPal account as a fallback. It's even part of many German memes around the German way of always splitting the bills, even if it's just < 5 euros.
OroPla
What you are describing sounds like a weird alternative reality. I never heard of always splitting bills, either. But it's not exactly a homogeneous country. To the point everyone jokes that Bavaria isn't even German, for example.

Depending on which state you are in, your experience can be vastly different.

All the states used to be kinda independent two hundred years ago. Including having different currencies. Unification happened 1871. Bismarck and later Hitler kinda brought the nation together, but after losing two world wars national pride got frowned upon and having the iron curtain cut through the country didn't help in fostering a German identity, either. Reunification was only 36 years ago. Though, about a third to maybe half of the German territory remains lost after losing the wars. Instead we got the EU. The more things change, the more they stay the same.

It's always funny to see foreigners make fun of German supposed clichés that I never had any exposure to whatsoever, like Lederhosen, which is only a thing in Southern Germany.

drdexebtjl
“I don’t use paypal, here’s cash”
DemetriousJones
I simply use it as an intermediary between my bank and any website I don't fully trust
fg137
I use "virtual card" for those needs. For me, it doesn't justify bringing out PayPal
dylan604
I've had to use it when my bank's purchase limits did not allow for card (virtual or real), but the same purchase was allowed when going through PayPal. It was annoying AF, but was much faster than contacting my bank and getting permission to spend my money.
k4rli
So both Paypal and Visa/Mastercard get a cut of every transaction. At least with a regular virtual card Paypal isn't getting their cut. Having Paypal as a middleman will make chargeback requests harder as well since they likely need to be negotiated with before the actual card issuing bank.
vlyan
because global-ish exchange of goods and services for money is a deliberately convoluted experience that only a handful of well-connected entities are allowed to facilitate, which enables each and every one of them to put "we reserve the right to fuck you in the ass for any or no reason" in their ToS.
dewey
Easy to say when you are in a country where you have a lot of options.

There's some countries with very bad financial sector where your option is PayPal or Western Union as the local banks don't know how to do international transfers, Remitly doesn't support all countries and Wise also doesn't work. PayPal works, even if they charge fees.

cloudie78
Which countries have local banks that don’t know how to do international transfers?
kalleboo
My local banks know how to international transfers but I have to go into a bank office and fill out a paper form.
cloudie78
Thank you for sharing your experience. I don’t know what your local banks are and what country you’re talking about.
[deleted]
(comment deleted)
dewey
We were having a lot of problems with that in Honduras, staff in the branch did not know how to do that, fees are extremely high and sometimes the bank system is just offline and you get sent home. There's a reason all these alternatives like Western Union etc. exist for this remittance use case.

It was a big reality check for me usually living in Germany and having access to a lot of banks and modern neo-banks.

FireBeyond
Oftentimes it's not necessarily that they don't know, but unless two international banks have a direct relationship, they have to use intermediary banks. Even my parent's large bank in Australia, when wiring me a gift towards my home purchase, had to go via an intermediary bank who could then forward-on to my bank.
dumberquestions
As a freelancer, clients often simply refuse to use anything other than PayPal, I've faced that scenario dozens of times.
qingcharles
For the unbanked, PayPal is like Chime and Cash App. A quick way to be able to deposit incomings and get a debit card where you can spend them.
deno
Works for me on GrapheneOS and pixel phone (without NFC).
onion2k
Has PayPal blocked GrapheneOS, or have they blocked every OS they're unable to verify and done a poor job of implementing their checks?

Hanlon's Razor is a useful tool. https://en.wikipedia.org/wiki/Hanlon%27s_razor

redleader55
You're a banking app. Why do you need to check my phone or my os? The security is not in what phone I use, but in how sane your 2-factor auth is and if even exists.
onion2k
You're a banking app.

I've been called worse.

basilikum
> have they blocked every OS they're unable to verify

This is evil in itself.

bossyTeacher
They have blocked rooted phones based on the error provided. Nothing to do with verification. They treat rooted phones to a level they don't with phones without critical security updates. That's the tension. Non-rooted phones aren't necessarily unsafer.
fylo
Graphene isn't rooted....
glitchc
We don't know if the OP has rooted their phone in addition to installing Graphene.
grapheneos
If they replaced the core of the OS with a rootkit, it wouldn't be GrapheneOS anymore but rather a derivative of it. They didn't do that and people should be clear if they have rather than calling it GrapheneOS.
4chandaily
It is a useful tool, but is largely irrelevant to this issue. To the end user, this isn't really much of a difference. Whether the cause is malice or simply not choosing to use the smallest effective brush, they are still taking an action that is preventing legitimate users from accessing the service.
folkrav
The very fact they've managed to convince anyone that checking what OS I decide to run on the devices I own to check my own banking is any of their concern is a problem in and of itself.
y-curious
Ironically, I had to apply Hanlon’s Razor to the impolite tone of your post
onion2k
"Ironic" means saying the opposite of what you mean in order to be funny or sarcastic. So that would mean you think I was both polite and not an idiot.

Jokes on you though, I'm neither of those things.

[deleted]
(comment deleted)
skinfaxi
Hanlon's razor is for people. Organizations do not operate like people and do not deserve the same deference.
grapheneos
PayPal accidentally broke support for GrapheneOS with the default settings for the app by adding incorrect anti-tampering code. It can be worked around using the per-app toggle to disable secure spawning. It shouldn't be necessary and we didn't expect there to be apps incompatible with secure spawning so we didn't originally design it to have a per-app toggle and had to add it.

Several of the more aggressive exploit protections are enabled for the base OS but are opt-in for user-installed apps. Memory tagging should work with all user installed apps but is opt-in because it's so good at detecting invalid memory accesses and uncovers a lot of bugs. Dynamic code loading via storage, dynamic code loading via memory and native debugging are allowed by default since a significant fraction of apps need those and it's not usually a bug. Users can set those as enabled by default for user installed apps which is particularly recommended for memory tagging but then people need to deal with the incompatibilities. The defaults don't cause issues with most apps so not everyone is aware of the per-app toggles.

Grisu_FTP
I still remember when my bank wanted me to run Android 9 instead of my Android 15 rom (without root) on my Samsung S8 because "muh security!!"

Funnily enough, the only way to hide those detections was to Root my phone... And i still remember when i had an appointment there, they wanted to see something in my Bank app, i opened it (and i assume it had an update since i then last used it) and a big "THIS DEVICE IS NOT SUPPORTED. ROOT IS NOT SUPPORTED" poped up

But was as simple as readding the bank app to my root hiders.

but still, i hate this security theater

ThomasGlanzmann
I'm on Debian Testing sometimes on amd64 and sometimes on m1. Paypal also doesn't like me. Than I have two options: I use a Windows VM to do the payment or I use another payment method. Most of the time I use the other payment method.
7r33
P10F, 2026081301, Aurora Store, secondary profile, flawless. Try harder.
grapheneos
It's because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
savwolf
This is what really makes me question if I want to continue to use GOS, already some UK banks apps (which are app only) don't want to run. I'm considering switching back to stock as I can't be bothered to try to find hacks and workarounds for daily necessities.
depressedpanda
I would never use a bank that is app only. Sounds like a horrible experience.
microsoftedging
Same experience in the UK, but it was the push that got me to switch from Lloyds to Nationwide if you're looking for another option. They're great, they even have offline 2FA methods as they send you a card reader for things like authing purchases or sign-ins. And the app still works :-)
Flere-Imsaho
I use revolut on a stock pixel 9, have been considering Graphene, but im worried about stuff like:

https://grapheneos.social/@GrapheneOS/117045625230764434

grapheneos
Revolut still works for the vast majority of our users due to our workarounds for their attempted ban on it. We got in contact with Revolut due to our thread and they appear willing to avoid banning it going forward despite their past moves to do it.
grapheneos
PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.

Have you tried the per-app exploit protection compatibility mode or the finer-grained toggles for those apps? 90% of banking apps work on GrapheneOS but MANY have problematic anti-tampering code requiring the per-app compatibility mode.

[dead] hoshi73
[dead]
grapheneos
This is a correct answer despite the fact that it was previously hidden by flagging. PayPal's recent updates with incorrect anti-tampering code work fine on GrapheneOS when secure app spawning is disabled. It's best to disable only secure app spawning (exec-based spawning) for it instead of using the whole compatibility mode. Using the whole compatibility mode is the first thing to check before narrowing it down though.
ButlerianJihad
So the OP is just lying out of ignorance and rash judgement, and spreading calumny about PayPal. And PayPal has done nothing to their app to block GrapheneOS. And hundreds, thousands of participants on HN have been misled by another rogue "Tell HN". Good times.
dennemark
Looking at the description, the title should be changed to "Contactless PayPal card does not run on GrapheneOS"

I use latest Aurora Store PayPal version and it still works. I just dont use contactless payment.

hashworks
I'm not using the contactless payment feature and get the same crash and error.
grapheneos
The app can still be used too but requires the per-app secure spawning toggle with recent app versions. It's due to PayPal shipping buggy anti-tampering code.
grapheneos
It's not specific to contactless payments. It's a bug in the app and still works with the per-app spawning toggle disabled. The per-app exploit protection compatibility mode sets all these toggles to the compatibility mode but it's best to figure out the minimum required.
StrLght
Still works for me.

I had to update exploit protection after their latest update — I think it was enabling dynamic code loading via both memory and storage that did the trick.

codethief
Still works for me, too, and I haven't disabled any of Graphene's security features.
grapheneos
Based on user reports, there are recent updates to PayPal requiring disabling the per-app secure spawning toggle. It already required not enabling some of the other protections which are opt-in for user installed apps.

Secure spawning doesn't cause compatibility issues with non-buggy apps (unlike blocking dynamic code loading via memory/storage or native debugging) and apps rarely have issues with it (unlike memory tagging, which finds lots of bugs) so it's on by default.

anonymousiam
Hopefully these stupid companies that are refusing to allow their apps to run on GrapheneOS will have a change of heart when Motorola begins launching their new phones:

https://arstechnica.com/gadgets/2026/08/motorolas-grapheneos...

master-lincoln
if there is enough money to be made they will consider it...
grapheneos
PayPal's app still works with our per-app secure spawning toggle disabled. It's a bug in their anti-tampering code.