Tell HN: PayPal blocks GrapheneOS
Tell HN: PayPal blocks GrapheneOS
It seems like the PayPal app now refuses to run on GrapheneOS. I don’t know if it’s only because I have enabled the PayPal card for contactless NFC payments, but when opening the app it crashes with the following exception: com.paypal.oslo.app.rasp.RootDetectionSecurityException: Security policy violation: s=root
看起来 PayPal 应用现在拒绝在 GrapheneOS 上运行。我不确定这是否仅仅是因为我启用了 PayPal 卡的 NFC 非接触式支付功能，但当我打开应用时，它会崩溃并抛出以下异常：com.paypal.oslo.app.rasp.RootDetectionSecurityException: Security policy violation: s=root
axegon_: This is arguably the most irritating thing with just about every largecorp developer: “os that hasn’t been updated in 6 years? Sure boss!”. Os that is built specifically around security and privacy with daily updates: “No, you can’t do that”. Annoying - yes. Safe way to make sure I will stop being your customer - also YES!
axegon_： 这可以说是几乎所有大公司开发者最令人恼火的事情：“一个 6 年没更新的操作系统？没问题，老板！”而对于一个专门围绕安全和隐私构建、且每日更新的操作系统，他们却说：“不，你不能那样做”。这很烦人——确实。但这也是确保我不再成为你们客户的“安全”方式——没错！
grapheneos: PayPal app still works on GrapheneOS. It’s because PayPal shipped an update with incorrect anti-tampering code incompatible with secure app spawning. It can be worked around with the per-app secure app spawning toggle until they fix it.
grapheneos： PayPal 应用在 GrapheneOS 上仍然可以运行。这是因为 PayPal 发布了一个更新，其中包含与“安全应用启动”（secure app spawning）不兼容的错误防篡改代码。在他们修复之前，可以通过针对该应用的“安全应用启动”开关来绕过这个问题。
The first thing to try when an app doesn’t work is trying the per-app exploit protection compatibility mode. That sets all the per-app exploit protection toggles to the compatibility mode. If that works which is likely the problem, it can be narrowed down.
当应用无法运行时，首先要尝试的是针对该应用的“漏洞利用保护兼容模式”。这会将所有针对该应用的漏洞利用保护开关设置为兼容模式。如果这样有效（这很可能是问题所在），那么问题范围就可以缩小了。
Nearly all Android apps are compatible with GrapheneOS. The exception are around 10% of banking and government apps which use the Play Integrity API to ban using a non-Google-approved device or OS. That’s visible to users on GrapheneOS via a Play Integrity API usage notification.
几乎所有的 Android 应用都与 GrapheneOS 兼容。例外情况大约占银行和政府类应用的 10%，它们使用 Play Integrity API 来禁止使用非谷歌认证的设备或操作系统。GrapheneOS 用户可以通过 Play Integrity API 的使用通知看到这一点。
After the first use by an app, GrapheneOS provides a menu for blocking using the Play Integrity API which sometimes gets apps working because many don’t enforce it working. It’s not fully reliable and can have downtime so apps often don’t enforce providing a result.
在应用首次使用后，GrapheneOS 会提供一个菜单来拦截 Play Integrity API 的调用，这有时能让应用正常工作，因为许多应用并不强制要求其必须返回结果。这种方法并不完全可靠，且可能存在停机时间，因此应用通常不会强制要求提供结果。
fluidcruft: Generally I think the issue is that there’s a tension between your security vs Paypal’s security (deliberate, motivated bad actors). Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy’s hands is a good thing to prevent robberies. Guns in a bad guy’s hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don’t know if you’re a good guy or a bad guy so it’s easier to just ban guns.
fluidcruft： 总的来说，我认为问题在于你的安全需求与 PayPal 的安全需求（针对蓄意、有动机的恶意行为者）之间存在冲突。也许可以用金属探测器作为减少银行抢劫的手段来做类比。好人手中的枪是防止抢劫的好东西，坏人手中的枪则是防止抢劫的坏东西。PayPal 知道你有枪，但他们不知道你是好人还是坏人，所以直接禁枪更容易。
axegon_: That’s your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don’t have to legally be adult to buy any of the things you’d need and I say that as someone who only struggled with chemistry in school, that’s now low the bar is. What’s the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronomically lower than any Chinese spyware-infested phone.
axegon_： 这就是你的论点？伙计，你可以用在任何超市都能买到的东西制造炸药，没人会眨一下眼。你甚至不需要达到法定成年年龄就能买到所有需要的东西。作为一个在学校化学课上都很吃力的人，我得说，现在的门槛就是这么低。那解决方案是什么？禁止海盐吗？如果有人在使用 GrapheneOS，他们被黑客攻击的几率要比使用任何充斥着中国间谍软件的手机低得多。
HenriTEL: The problem here seems to be that the phone is detected as rooted, not specifically that it’s running grapheneOS. But I agree that it’s a big problem. That’s how you end up in a situation where google has full control from hardware to final apps like on iphones. When devs assume that everybody is using the stock android with google services enabled.
HenriTEL： 这里的问题似乎是手机被检测为已 Root，而不是专门针对 GrapheneOS。但我同意这是一个大问题。这就是为什么最终会导致谷歌像 iPhone 一样，从硬件到最终应用都拥有完全控制权。当开发者默认每个人都在使用开启了谷歌服务的原生 Android 系统时，情况就是这样。
svpk: GrapheneOS is not rooted. The phone not being rooted is part of the GrapheneOS’ security model. I assume the issue is it failing the deeper play integrity check which is about it not being “Google approved.”
svpk： GrapheneOS 没有 Root。手机未 Root 是 GrapheneOS 安全模型的一部分。我推测问题在于它未能通过更深层的 Play Integrity 检查，即它不是“谷歌认证”的。
grapheneos: It isn’t due to the Play Integrity API. That shows a notification on GrapheneOS with a toggle for blocking it to work around it for services not enforcing providing a result. If that was the issue, the original poster would have known from the notification. The issue ended up being PayPal shipping incorrect anti-tampering code incompatible with secure spawning. The original poster figured that out and got it working by disabling the per-app secure spawning toggle.
grapheneos： 这不是因为 Play Integrity API。GrapheneOS 会显示相关通知，并提供一个拦截开关，以便绕过那些不强制要求返回结果的服务。如果问题出在这里，原帖作者会通过通知得知。最终的问题是 PayPal 发布了与“安全启动”不兼容的错误防篡改代码。原帖作者发现了这一点，并通过禁用该应用的“安全启动”开关使其恢复正常。
ryandrake: How did we let “rooting” become some evil thing? It’s normal to have root (or Administrator) on your devices. After all, they are yours. They don’t belong to the device manufacturer. You should have full access to your own devices by default. Only recently did we somehow normalize the idea that the user should not be the ultimate decider over their own devices.
ryandrake： 我们是怎么让“Root”变成一件邪恶的事情的？在自己的设备上拥有 Root（或管理员）权限是很正常的。毕竟，设备是你的，它们不属于设备制造商。默认情况下，你应该拥有对自己设备的完全访问权限。直到最近，我们才不知何故将“用户不应是其设备最终决策者”这一观念常态化了。
grapheneos: It does not have a root privilege mode. GrapheneOS doesn’t weaken any aspect of the standard security model. It has all of the standard security model and features including hardware-based security intact. It greatly improves security rather than doing that. User accessible root access is available in userdebug (non-production) builds. There’s no system for granting root access to apps. It’s no different from the stock OS in this regard, but it’s a lot more secure than the stock OS.
grapheneos： 它没有 Root 权限模式。GrapheneOS 没有削弱标准安全模型的任何方面。它保留了所有标准安全模型和功能，包括基于硬件的安全机制。它是在极大提升安全性的基础上做到的，而非削弱。用户可访问的 Root 权限仅在 userdebug（非生产）版本中提供。没有为应用授予 Root 权限的系统。在这方面，它与原生系统没有区别，但它比原生系统安全得多。