7 ms·

Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors). Maybe an analogy could be

• encom 20d ago
  How does a rooted phone enable bank fraud? This smells like pointless policy checkboxing.
  • biosboiii 20d ago
    If you run a rooted phone and download malware, that malware can gain root and do payments on your behalf. Then PayPal has to deal with you revoking payments etc., they don't want to so they forbid you from using PayPal on a rooted phone.
    • master-lincoln 20d ago
      If this happens it's the device owners fault and they should be responsible for it.
      • Grombobulous 20d ago
        Which they would be anyway since PayPal isn’t a bank and isn’t FDIC insured. They allow you to open PayPal.com on any web browser. Running Windows/macOS/Linux is basically identical to a rooted Android phone (you have local admin rights, you can modify and automate the browser, and can run unsigned code).
      • bayindirh 20d ago
        No, no... In 2026, all footguns are banned. Even in programming, so if something allows a footgun, it's banned now. Apparently the world can't adult and be responsible for their actions, or people believe in that.
    • deleted 20d ago
      [deleted]
    • fylo 20d ago
      Graphene isn't rooted.
      • Grombobulous 20d ago
        Not only is it not rooted, it runs real Google Play services. It’s not microG.
    • ruszki 20d ago
      Malwares can possibly do that even on non rooted phones if a privilege escalation attack is possible. And just yesterday, there was an article here about exactly one of those. Also I highly doubt that there is any real statistics anywhere about whether this is a real threat or not. I guarantee that nobody did such statistics properly. The only known data is from companies which sell root prevention tools, so totally unreliable. And internally I guarantee, that no banks collect such info. So no, banks lie about this only because they can sell this to judges as safety feature, when they fuck up, which happens continuously.
    • encom 20d ago
      For that argument to hold, they'd also have to blacklist any phone not running the newest, most up to date Android version, because all older versions presumably have known exploits. So that basically leaves Pixel phones.
    • yjftsjthsd-h 20d ago
      If you have a rooted phone, download malware, and hit the allow button to give the malware root access, then it can do whatever it wants. If you have a nominally unrooted phone on an old Android version and download malware, it can exploit a kernel bug and give itself root access and do whatever it wants. Protecting against the first case and not the second is at best security theater.
  • iamnothere 20d ago
    Graphene OS does not support root. This is a false positive based on some check they are doing.
    • fluidcruft 20d ago
      It's probably just a generic error message for failing that Google Play Protect thingamajigger that attests provenance of the vendor OS from boot. Will be interesting to see whether the Motorola phones have this endorsement when they ship. Most devices would probably fail because they are rooted rather than because they are GrapheneOS. I wouldn't put it past a scammer talking grandma into rooting their phone.
      • br0ceph 20d ago
        [flagged]
        • grapheneos 20d ago
          It will be possible to install the official GrapheneOS on the devices. Shipping devices with the official GrapheneOS is planned but may not be there at launch.
      • grapheneos 20d ago
        It isn't due to the Play Integrity API. That shows a notification on GrapheneOS with a toggle for blocking it to work around it for services not enforcing providing a result. If that was the issue, the original poster would have known from the notification. The issue ended up being PayPal shipping incorrect anti-tampering code incompatible with secure spawning. The original poster figured that out and got it working by disabling the per-app secure spawning toggle.
        • fluidcruft 19d ago
          Thank you for the clarification!
  • goonersallofyou 20d ago
    One thing that I'm actually excited about regarding AI is that the pointless policy checkboxes that have never been effective in adding any actual security are even less so effective now that everyone can wield their very own security researcher.
    • edoceo 20d ago
      PHB at insurance company will still need them, so any company they insure will need them. Theater continues, the show must go on.
  • izacus 19d ago
    One common issue is to use rooted phones to automatically drive banking apps to commit fraud at scale. Create lots of fake accounts, bounce transactions, use them to automate phishing scams, etc. Massively harder to do that on a non rooted device.
• axegon_ 20d ago
  That's your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don't have to legally be adult to buy any of the things you'd need and I say that as someone who only struggled with chemistry in school, that's now low the bar is. What's the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronomically lower than any Chinese spyware-infested phone.
  • john_strinlai 20d ago
    physical risks, like your example, do not map well to digital risks faced by large international companies.
    • axegon_ 20d ago
      It was a response to the gun example which is a physical risk. My argument is that Paypal (much like all other tech-bro companies) are incompetent. The incompetence grows exponentially the larger a software company is. I speak of experience. On a side note, if you want to be extremely specific, the line between the physical and digital threat does not exist anymore. There are two things people need to be afraid of: incompetent friends and competent enemies. Tech giants are already filled to the brim with incompetent friends, which drastically lowers the bar for the competence of their enemies.
  • pkulak 20d ago
    It was an analogy, or metaphor, I forget the distinction. But I don't think it was stood up to be literally argued against though.
    • rc5150 20d ago
      then it was a bad analogy.
  • HenriTEL 20d ago
    The problem here seems to be that the phone is detected as rooted, not specifically that it's running grapheneOS. But I agree that it's a big problem. That's how you end up in a situation where google has full control from hardware to final apps like on iphones. When devs assume that everybody is using the stock android with google services enabled.
• brightball 20d ago
  Yea, years ago I was in the security space and got to talk to some paypal security folks at a symposium in San Diego. The level of stuff that they have to deal with is so extreme. It's similar to how people don't like sites blocking entire countries or access from Tor, etc. You might be doing it for privacy...but all the people trying to commit fraud are also using those same channels to hide their identity. The blockades are one piece of a holistic security picture that frustrate the well intentioned users.
  • axegon_ 20d ago
    Yet another weak point. My question stands: A user with an OS from 2019 is "secure" and dozens of unpatched CVEs but a literally-last-night-patch OS is not? That's the "stuff they have to deal with"? I was lucky and did not make the mistake of joining a payment provider in 2020 or 2021 (I can't remember). The reality is that European laws are much harsher when it comes to payments and personal data protection and the security team I was being interviewed for was catastrophic(big part of the reason I did the "I accepted another offer already, sorry" card). As for geo fencing or blocking Tor... HAH! As if that's ever stopped anyone with the will. That is the last concern of anyone with a malicious intent. Sure, it stops irritating kids but no one beyond that. The simple fact is that cybersecurity was in an abysmal state before the slopification began and it's infinitely worse now. Paypal is no different given that much of their support has been outsourced to slop machines. Punishing the users that know what they are doing while rewarding the ones that don't is the most counter-productive and detrimental crap anyone could come up with.
    • browningstreet 20d ago
      > That's the "stuff they have to deal with"? No. It's the offensive fraud vector coming from unsecured devices that account for a significant portion of the noise. Requiring device profiling aggravates this vector.
      • axegon_ 20d ago
        > unsecured devices that account for a significant portion of the noise. Requiring device profiling aggravates this vector. Bullshit! Source: > The reality is that European laws are much harsher when it comes to payments and personal data protection and the security team I was being interviewed for was catastrophic Sounds like someone who wanted to impress the audience with fluffed up claims.
• dmichulke 20d ago
  To stay with your analogy, there is no technical obstacle to treating the customer of 15 years differently to the newly onboarded one. They have all the data they need, and they choose not to use it.
  • fluidcruft 20d ago
    The analogy was not about new vs old customers being allowed to have guns. I think that's a limitation of the analogy because there is no correspondence with trusted computing. I guess it would be some sort of a magical gun that some other company is endorsing as of limited use during bank robberies? Maybe like some sort of RFID thing that disables the gun when inside a bank? Anyway it really stretches the analogy to get tied up in technical details (risks missing the forest for the trees type error).
• dathinab 20d ago
  this isn't quite true From a Paypal security POV, weather you use "custom Android OS" or an hugely outdated Android phone, you have: - a similar risk for the "you" want to mess with Paypal case, in both cases the "you" can technically most likely mess with anything including the "virtual secure module" thingy android uses for NFC - a lower risk for "others" wanting to mess with Paypal through your phone, at least if "custom Android OS" is GrapheneOS or another up-to-date android fork with decent security handling so as far as I can tell, this inconsistency is very clearly not about PayPal's security. IMHO it's about two other things: 1. marketing, if PayPal doesn't work on Android they lose customers, GrapheneOS for now has a tool small customer base for them to care. Outdated Android phone do have a large customer base. 2. compliance/politics BS. including potentially involving insurance. Compliance is mostly about checking of tickmarks(1) on outdated Android they can check them off and blame the user, Goodle or "hackers" for the issue. On GraphemeOS they have a harder time checking it of. Add the smaller user base and end up with PayPal doesn't care. Also iff things go wrong with Paypal on GraphemeOS in a public manner you will have all the "crime os" bad news bs, you won't have that if things go wrong with a even more risky highly outdated Android phone. ----------------------- I got a bit to much off topic below: (^1): Technically compliance should be about building robust, secure, law compliant systems and "showing" that by being able to pass a compliance tests consisting about a bunch of requirements. Practically there is way to many ways you can be "fully compliant" (on paper) but not secure and "very secure" but not compliant (wrt. security regulations). In the former case this might still come back and bite you iff you get sued or people suing which should get right don't get it because of ad-absurbum reasoning like "they comply with security regulations, hence can't have acted negligent". It's a shit show I don't know how to fix even if I could just magically change laws as compliance rules need technological flexibility, but if you give them that that will be abused to make insecure things pass. And the whole industry around checking that isn't really one who cares about actual security, sometimes outright corrupt (like groups which have the necessary accredited to check your compliance, are strangely more expensive then other groups, and somehow find less issues in average, with some excuse of why that isn't strange ...) :/ --- Lastly similar to how Teams or Slack could easily support FF (^2) but not only don't but outright refuse to try to even work. PayPal likes to act similar and doesn't care about niches. E.g. at least on some Mobile browsers WebAuthn works, but the PayPal website refuses to _even try_ 2FA with WebAuthn on mobile no matter if the APIs are there or not. (^2): Yes there are some challenges, AFIK especially in certain edge cases most user might never run into. But Jitsi made it work, other smaller apps also made it work. And Jitsi is open source, so they technically can "look up" all the tricks to make it work (algorithmic ticks, not copy-pasting code) or outright just use their system with an appropriate contract (probably would be even cheaper wrt. maintenance cost then building your own system). At Slack/MS Teams scale that behavior is just messed up.
• kevin_thibedeau 20d ago
  The cherry on top is that their web site invariably still works so the refusal to work via app is an intentional manipulation tactic to harvest more consumer data for sale.
  • gvurrdon 20d ago
    Sadly, their website now appears to require an app in order to sign in. Even before that it would often block me with text along the lines of "We don't know who you are, call our support number."
    • kevin_thibedeau 20d ago
      Desktop mode fixes discrimination against small viewports.
      • gvurrdon 20d ago
        This was happening to me on the desktop. I've not tried on a phone (I try to avoid PayPal).
    • HeyLaughingBoy 20d ago
      PayPal? I sign in all the time. If you're referring to the popup to add a new authentication method, you can just escape past it.
  • fluidcruft 20d ago
    I'm fairly skeptical the website supports NFC payments.
• RunSet 20d ago
  > Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A more apt analogy might be game developers who demand admin rights so they can install a rootkit to detect "cheating".
  • BobaFloutist 20d ago
    They wouldn't do that if there weren't market demand. Competitive games lose their appeal when cheating becomes too prevalent. Similarly, payment processors lose their appeal if they can't prevent people stealing your money, or spending stolen money on your products.
• akimbostrawman 20d ago
  Paypal's security? the same "security" which in 2026 still does no allow a passwords above 32 character (which most likely indicating that they don't hash passwords)?
• DANmode 20d ago
  This might make sense if you trusted clients, and if GrapheneOS was a root-having OS.
• wolvoleo 20d ago
  I think the issue is more that big tech only trusts their own kind and usually has motives to exclude privacy conscious software because they can't datamine it or make backroom exclusivity deals. The needs of the user don't matter to them at all.
• grapheneos 20d ago
  There's no tension between the security of PayPal against bad actors and support for GrapheneOS. GrapheneOS preserves the whole standard security model and greatly improves security. It's far more secure than anything permitted by the Play Integrity API device or strong integrity levels. Thankfully, PayPal hasn't banned GrapheneOS and their app still works on it. They accidentally broke compatibility with our secure app spawning feature which has a per-app toggle to disable it along with the other exploit protections which can cause compatibility issues. There's an overall per-app compatibility mode toggle instead of users needing to figure out which protection is an issue but it's best to figure out the minimal workaround after determining that works.