IdeaWell

Project ideas from Hacker News discussions.

Tell HN: PayPal blocks GrapheneOS

Hacker News Discussion

📝 Discussion Summary (Click to expand)

Theme 1: False positive detection
GrapheneOS is often flagged as “rooted” or non‑compliant due to indirect checks (custom ROM detection, Play Integrity) rather than actual root access.

“Well I haven't rooted my device. It's just normal grapheneos” – leumon
“These days, root is mostly flagged via indirect indicators rather than detecting the root binary itself. For instance, detecting custom ROMs is a common clue.” – therealmarv

Theme 2: Workarounds and technical fixes
Users report that disabling specific GrapheneOS security features (e.g., “Secure app spawning”) or using exploit‑protection compatibility mode lets PayPal work, or they fall back to the web version.

“But disabling 'Secure app spawning' seems to fix it for now.” – leumon
“I've been using it in the browser with GOS no problem.” – Schnittbrot

Theme 3: Corporate motives / security theater
Many commenters argue the blocks stem from liability concerns, compliance checkboxes, or a desire to avoid supporting niche OSes—not genuine security improvements.

“From a Paypal security POV … this inconsistency is very clearly not about PayPal's security. IMHO it's about two other things: 1. marketing … 2. compliance/politics BS.” – dathinab
“This is arguably the most irritating thing with just about every largecorp developer: 'os that hasn't been updated in 6 years? Sure boss!'. Os that is built specifically around security and privacy with daily updates: 'No, you can't do that'.” – axegon_

Theme 4: Community response and alternatives
The community advocates contacting companies, leaving reviews, growing the user base, and exploring alternatives like Wero or SEPA transfers.

“We have to make ourselves get heard. It's a social problem after all. Technical workarounds are great … but we have to fix the social issue at the root.” – basiliku
“The best approach to combat this is to cause as much headache as possible: bombard them with 1‑star reviews, contact news sites, post this on social media …” – Itoldmyselfso
“Switched to Wero and haven't looked back.” – aabdelhafez

🚀 Project Ideas

IntegrityCheck Lab

Summary

  • Automated testing service that runs Android apps on GrapheneOS emulators and real devices to detect false-positive root/custom-ROM detection and Play Integrity failures.
  • Provides developers with actionable reports and remediation steps to broaden app compatibility while preserving security.

Details

Key Value
Target Audience Mobile app developers, especially fintech and payment apps
Core Feature CI/CD integration that installs app on GrapheneOS, runs Play Integrity API checks, logs root detection triggers, and suggests fixes
Tech Stack Android Emulator (GrapheneOS build), Fastlane, GitHub Actions, Python reporting API, PostgreSQL
Difficulty Medium
Monetization Revenue-ready: SaaS subscription per app/month (tiered)

Notes

  • HN users complained about PayPal blocking GrapheneOS due to flawed root detection (e.g., "PayPal isn't actively trying to block GrapheneOS as of now" but still crashes). This service would give them data to fix it.
  • Enables discussion on security theater vs real risk, and could reduce unnecessary exclusions of privacy‑conscious users.

GrapheneShim

Summary

  • A lightweight runtime shim that intercepts Play Integrity, SafetyNet, and root‑detection APIs, returning values that match a stock Android device while keeping the underlying GrapheneOS security intact.
  • Allows apps that mistakenly treat GrapheneOS as rooted to run without disabling exploit‑protection features.

Details

Key Value
Target Audience GrapheneOS users who need to use banking/payment apps that fail on stock builds
Core Feature Xposed‑style module (or eBPF‑based) that hooks com.google.android.gms.security APIs and returns MEETS_STRONG_INTEGRITY, SafetyNet passes, and hides root flags
- Tech Stack Android NDK, Frida/GumJS for hooking, GrapheneOS signed module, optional Magisk‑like loader
Difficulty High
Monetization Revenue-ready: One‑time purchase $9.99 or donation‑supported open source with premium support

Notes

  • Commenters noted disabling "secure app spawning" as a workaround (leumon: "Disabling 'Secure app spawning' seems to fix it for now") – GrapheneShim would automate a safer fix.
  • Provides a practical utility that preserves GrapheneOS hardening while satisfying app attestation, sparking debate on the balance between security and compatibility.

AppBlock Reporter

Summary

  • A community‑driven portal where GrapheneOS users can submit instances of apps that refuse to launch, automatically generate polite feedback emails to developers, and track resolution status.
  • Aggregates data to highlight patterns (e.g., Play Integrity Strong requirements) and pressure vendors to improve compatibility.

Details

Key Value
Target Audience GrapheneOS users, privacy advocates, and developers seeking user‑feedback
Core Feature Simple form to capture app name, version, error message; integrates with GitHub Issues or developer support APIs; public dashboard of reports
Tech Stack React frontend, Node.js backend, Firebase/Firestore for storage, SendGrid for email notifications
Difficulty Low
Monetization Hobby

Notes

  • Users like bazilikum emphasized the social aspect: "We have to make ourselves get heard... Technical workarounds are great... but we have to fix the social issue at the root." This platform directly addresses that.
  • Generates reproducible data for HN discussions, enabling concrete examples of apps that block GrapheneOS and measuring impact of advocacy.

SEPA Instant Wallet

Summary

  • A web‑based peer‑to‑peer payment service that works in any modern browser (including GrapheneOS Firefox) using WebAuthn for strong customer authentication and SEPA Instant Credit Transfer for settlement, eliminating the need for a native app that may fail Play Integrity checks.
  • Provides PayPal‑like convenience (phone‑number or email lookup) without requiring device attestation.

Details

Key Value
Target Audience EU residents, especially GrapheneOS users who need a PayPal alternative for P2P payments
Core Feature Browser wallet: lookup contacts via phone/email, authenticate with WebAuthn (platform authenticator), initiate SEPA Instant transfers, request money, view transaction history
Tech Stack TypeScript/Vite frontend, WebAuthn library, Node.js backend with SEPA‑ISO 20022 API (e.g., via a banking‑as‑a‑service provider), PostgreSQL, Docker
Difficulty Medium
Monetization Revenue-ready: Low‑fee per transaction (e.g., €0.20) or premium subscription for business features

Notes

  • Several commenters wished for a PayPal alternative that works on GrapheneOS (e.g., "Switched to Wero and haven't looked back" but noted limitations). SEPA Instant Wallet offers a broader, bank‑agnostic solution.
  • Enables discussion on moving away from app‑centric attestation to web‑based, privacy‑respecting payment methods, aligning with GrapheneOS's security goals.

Read Later