2 ms·
Has PayPal blocked GrapheneOS, or have they blocked every OS they're unable to verify and done a poor job of implementing their checks? Hanlon's Razor is a use
by onion2k 1mo ago
Has PayPal blocked GrapheneOS, or have they blocked every OS they're unable to verify and done a poor job of implementing their checks?
Hanlon's Razor is a useful tool. https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- redleader55 1mo agoYou're a banking app. Why do you need to check my phone or my os? The security is not in what phone I use, but in how sane your 2-factor auth is and if even exists.
- onion2k 1mo agoYou're a banking app. I've been called worse.
- basilikum 1mo ago> have they blocked every OS they're unable to verify This is evil in itself.
- bossyTeacher 1mo agoThey have blocked rooted phones based on the error provided. Nothing to do with verification. They treat rooted phones to a level they don't with phones without critical security updates. That's the tension. Non-rooted phones aren't necessarily unsafer.
- fylo 1mo agoGraphene isn't rooted....
- glitchc 1mo agoWe don't know if the OP has rooted their phone in addition to installing Graphene.
- grapheneos 29d agoIf they replaced the core of the OS with a rootkit, it wouldn't be GrapheneOS anymore but rather a derivative of it. They didn't do that and people should be clear if they have rather than calling it GrapheneOS.
- 4chandaily 1mo agoIt is a useful tool, but is largely irrelevant to this issue. To the end user, this isn't really much of a difference. Whether the cause is malice or simply not choosing to use the smallest effective brush, they are still taking an action that is preventing legitimate users from accessing the service.
- folkrav 1mo agoThe very fact they've managed to convince anyone that checking what OS I decide to run on the devices I own to check my own banking is any of their concern is a problem in and of itself.
- y-curious 1mo agoIronically, I had to apply Hanlon’s Razor to the impolite tone of your post
- onion2k 1mo ago"Ironic" means saying the opposite of what you mean in order to be funny or sarcastic. So that would mean you think I was both polite and not an idiot. Jokes on you though, I'm neither of those things.
- deleted 1mo ago[deleted]
- skinfaxi 1mo agoHanlon's razor is for people. Organizations do not operate like people and do not deserve the same deference.
- grapheneos 29d agoPayPal accidentally broke support for GrapheneOS with the default settings for the app by adding incorrect anti-tampering code. It can be worked around using the per-app toggle to disable secure spawning. It shouldn't be necessary and we didn't expect there to be apps incompatible with secure spawning so we didn't originally design it to have a per-app toggle and had to add it. Several of the more aggressive exploit protections are enabled for the base OS but are opt-in for user-installed apps. Memory tagging should work with all user installed apps but is opt-in because it's so good at detecting invalid memory accesses and uncovers a lot of bugs. Dynamic code loading via storage, dynamic code loading via memory and native debugging are allowed by default since a significant fraction of apps need those and it's not usually a bug. Users can set those as enabled by default for user installed apps which is particularly recommended for memory tagging but then people need to deal with the incompatibilities. The defaults don't cause issues with most apps so not everyone is aware of the per-app toggles.