Workaround for Play Integrity on GrapheneOS — Possible?

Kadir3169

I know this topic comes up all the time, and yes I searched up the forum about the topic, but I’m still trying to figure out if there’s any real-world way to get Google Wallet (tap to pay) working on GrapheneOS these days.

I’ve seen guides like this:

XDA: How to pass Strong Integrity

YouTube walkthrough

Has anyone here actually tried any of this on GrapheneOS? I've seen someone to pass this to work on LineageOS (Link) Does it even stand a chance with verified boot and the whole security model? Or is that basically impossible because that’s the whole point of GrapheneOS in the first place?

I’m not looking to break the whole security benefit, just wondering if anyone found a practical workaround, or if it’s really a dead end and better to just carry a second phone with stock Android or a Watch for NFC payments.

Any first-hand experience would be super helpful.

other8026

Kadir3169 No. It would require spoofing, which may work for a few people who do hacky things on their own, but if GrapheneOS added it Google would find out and block it right away because of how many users we have.

See responses in the issue tracker starting here: https://github.com/GrapheneOS/os-issue-tracker/issues/1986#issuecomment-1862602531 and others by the same person in that discussion. They explain why it's not really possible for GrapheneOS to do that.

Delaney The short answer is that GrapheneOS hasn't figured out a robust workaround for this that doesn't involve compromising security.

There doesn't seem to be a way to do so even while compromising security. Spoofing may work very briefly, but won't work in the long run.

What we're left with is either hoping Google will change how this works out the goodness of their hearts or regulators stepping in and putting a stop to their anti-competitive behavior.

other8026

Kadir3169 appears they're spoofing they're different devices. So, like what was said in the issue tracker, if GrapheneOS tried spoofing, Google would find out very quickly and put a stop to it.

Also, this is funny

Kadir3169 XDA: How to pass Strong Integrity

(from the readme of one of the Play Integrity Fix modules)

Can this module pass MEETS_STRONG_INTEGRITY?

No...

Delaney

The short answer is that GrapheneOS hasn't figured out a robust workaround for this that doesn't involve compromising security.

A partial solution was introduced in release 2025012600 that blocks apps from using the Play Integrity API, which might work on a per-app basis depending on how the app responds to it.
https://grapheneos.org/releases#2025012600

Kadir3169

other8026 How about the links above? How are they manage to do that on a custom OS?

ralm

Kadir3169
The prerequisites to that XDA guide are an unlocked bootloader and root access along with various modules installed in the respective root manager app for all manner of spoofing (locked bootloader, build props, etc.), all in order to bypass an increasingly stricter Play Integrity API and avoid detection. So yeah, mods like this defeat the purpose of running Graphene.

If you're determined to try root methods your best chance is with a Pixel running stock. But what was easy at one time has become a time sucking exercise in frustration and short term gain.

wizoatk

other8026 Also, this is funny [...]

My understanding is that it was and possibly still is a rather fluid game of whack a mole going on. I believe that both the PIF module documentation and the XDA article were both correct at their individual time of writing.

Skorp

From my understanding, the other consideration is that if Google/apps using Play Integrity wanted to, they could force the use of STRONG which does utilize the Hardware Attestation API, or at least does something similar where it is cryptographically verified from a root of trust that it is running unaltered, stock OS.

This can't be spoofed.

Kadir3169

Skorp With a Keybox File, rooted and unlocked bootloader, it is possible.

See Link

In my case, that will not be possible, because device would physically not be secure, and GrapheneOS would be useless.

other8026

Kadir3169 This part I'm pretty sure they're using leaked keys or certificates somehow? From what I can tell, Google eventually figures it out and revokes the key/certificate, so people have to keep updating the files.

Assuming I do understand this correctly, that would mean if GrapheneOS were to do the same thing Google could very easily detect it, revoke things on their end, and then suddenly things will break for thousands of GrapheneOS users.

Keep in mind that GrapheneOS isn't some nameless OS. If GrapheneOS does something to spoof or otherwise get device or strong integrity verdicts, Google will know about it right away.