7 ms·

The problem here seems to be that the phone is detected as rooted, not specifically that it's running grapheneOS. But I agree that it's a big problem. That's ho

The problem here seems to be that the phone is detected as rooted, not specifically that it's running grapheneOS. But I agree that it's a big problem. That's how you end up in a situation where google has full control from hardware to final apps like on iphones. When devs assume that everybody is using the stock android with google services enabled.

Melatonic 20d ago
[flagged]
- nulld3v 20d ago
  [flagged]
- grapheneos 20d ago
  It does not have a root privilege mode. GrapheneOS doesn't weaken any aspect of the standard security model. It has all of the standard security model and features including hardware-based security intact. It greatly improves security rather than doing that. User accessible root access is available in userdebug (non-production) builds. There's no system for granting root access to apps. It's no different from the stock OS in this regard, but it's a lot more secure than the stock OS.
svpk 20d ago
GrapheneOS is not rooted. The phone not being rooted is part of the GrapheneOS' security model. I assume the issue is it failing the deeper play integrity check which is about it not being "Google approved."
- grapheneos 20d ago
  It isn't due to the Play Integrity API. That shows a notification on GrapheneOS with a toggle for blocking it to work around it for services not enforcing providing a result. If that was the issue, the original poster would have known from the notification. The issue ended up being PayPal shipping incorrect anti-tampering code incompatible with secure spawning. The original poster figured that out and got it working by disabling the per-app secure spawning toggle.
ryandrake 20d ago
How did we let "rooting" become some evil thing? It's normal to have root (or Administrator) on your devices. After all, they are yours. They don't belong to the device manufacturer. You should have full access to your own devices by default. Only recently did we somehow normalize the idea that the user should not be the ultimate decider over their own devices.
- 6510 20d ago
  We've already progressed from "the user should not be" to "the user should never be". Perhaps we will even grow out of calling it "their own devices" eventually. If they can brick it remotely it kinda already isn't really yours?

Melatonic 20d ago

[flagged]

nulld3v 20d ago
[flagged]
grapheneos 20d ago
It does not have a root privilege mode. GrapheneOS doesn't weaken any aspect of the standard security model. It has all of the standard security model and features including hardware-based security intact. It greatly improves security rather than doing that. User accessible root access is available in userdebug (non-production) builds. There's no system for granting root access to apps. It's no different from the stock OS in this regard, but it's a lot more secure than the stock OS.

svpk 20d ago

GrapheneOS is not rooted. The phone not being rooted is part of the GrapheneOS' security model. I assume the issue is it failing the deeper play integrity check which is about it not being "Google approved."

grapheneos 20d ago
It isn't due to the Play Integrity API. That shows a notification on GrapheneOS with a toggle for blocking it to work around it for services not enforcing providing a result. If that was the issue, the original poster would have known from the notification. The issue ended up being PayPal shipping incorrect anti-tampering code incompatible with secure spawning. The original poster figured that out and got it working by disabling the per-app secure spawning toggle.

ryandrake 20d ago

How did we let "rooting" become some evil thing? It's normal to have root (or Administrator) on your devices. After all, they are yours. They don't belong to the device manufacturer. You should have full access to your own devices by default. Only recently did we somehow normalize the idea that the user should not be the ultimate decider over their own devices.

6510 20d ago
We've already progressed from "the user should not be" to "the user should never be". Perhaps we will even grow out of calling it "their own devices" eventually. If they can brick it remotely it kinda already isn't really yours?