3 ms·
Interesting, just inferring from that it sounds like GrapheneOS's actual-security features might have been tripping up PayPal's root-detection "security" featur
by Retr0id 2mo ago
Interesting, just inferring from that it sounds like GrapheneOS's actual-security features might have been tripping up PayPal's root-detection "security" features.
(Rather than something fundamentally incompatible, like them using Play Integrity)
- StrLght 2mo agoThere are valid RASP techniques that involve dynamic code loading, so it actually makes a lot of sense. Source: I worked on RASP a long time ago :) IMO headline is very misleading, and OP should have tried disabling all exploit protection options before jumping to any conclusions. PayPal isn't actively trying to block GrapheneOS as of now.
- skinfaxi 2mo agoSo to use paypal you actually have to reduce the security of the phone?
- iamnothere 2mo agoNot too surprising. I usually have to reduce my browser security on the rare occasion that I access PayPal via the web.
- StrLght 2mo agoAs with all things about security — it depends on your threat model. It reduces security of the app itself, but doesn't affect security of the phone by much.
- water-drummer 2mo ago[flagged]
- grapheneos 2mo agoIn this case, it only reduces the security of the app against exploits rather than the security of the OS. Secure spawning protects the app via unique ASLR bases, random memory tags, etc. Blocking dynamic code loading prevents common accidental vulnerabilities via insecure code loading and hardens against certain exploit techniques.