App compatibility is generally excellent on GrapheneOS. Nonetheless some apps may not function immediately, they suffer from bugs like memory corruption which our security features uncover as a byproduct. Others implement flawed security measures like Play Integrity or anti-tampering libraries that can cause issues. This thread lists various troubleshooting steps you can try which may make an affected app work.
Banking app compatibility with GrapheneOS
A community-sourced effort containing banking app compatibility information is maintained by us. As we rely on user reports GrapheneOS can't make any guarantees regarding the list's validity.
To submit, view, and/or track compatibility with banking, government related and various identification apps on GrapheneOS, please use this issue-tracker.
Quick shout-out to @spring-onion for maintaining and providing support for our banking app sub-project. Thank you for all your hard work and time you put into all this!
Possible solutions and steps to take
Note: An app may remember the previous conditions it ran under and may continue to show the same error message despite troubleshooting. To rule this out, clear the app's storage. This will cause data loss however, for banking and authentication apps in particular logging back in may require a new activation letter or similar measures.
1. Exploit protection compatibility mode
Enable the per-app exploit protection compatibility mode. Launch app.
Settings ➔ Apps ➔ App in question ➔ Exploit protection ➔ Exploit protection compatibility mode
Exploit protection compatibility mode acts as a master toggle for all subsequent settings so if the app starts working again you can then start figuring out which setting(s) specifically it's having trouble with. For banking apps and the likes in particular, the following two settings cause the most problems:
- Native code debugging, which can interfere with apps debugging their own code to add a barrier to analyzing their app.
- Secure app spawning, which is often flagged as suspicious by anti-tampering libraries.
2. Aurora Store
For apps that are distributed through Google Play only we recommend to use Sandboxed Google Play to obtain them. The Aurora Store may prove problematic for multiple reasons:
- It violates Google Play's terms of service and may cause used Google accounts to be disabled/blocked/blacklisted.
- It may not adhere to the same security standards that the Google Play Store enforces to validate the authenticity of app installations.
- Apps can check their install source and refuse to work if it's not the Google Play Store.
- The Play Store may act as a dependency to some apps.
3. Play Integrity
GrapheneOS will notify you if an app uses Play Integrity. App developers who opt in to using the Play Integrity API can filter out and block devices that don't meet the Play Integrity requirements specified by their settings. The 3 main verdicts are:
MEETS_BASIC_INTEGRITY, MEETS_DEVICE_INTEGRITY, MEETS_STRONG_INTEGRITY
Despite widely praised as one of the most secure operating systems, GrapheneOS isn't certified by Google so it doesn't pass the latter two verdicts.
More often than not there is no direct solution available. You can help by reaching out to the affected apps' developers and explaining them what they can do to resolve it. It involves them whitelisting GrapheneOS through the much more powerful hardware attestation API. We have a template on the PrivSec banking repository you can use. It's worded around Play Integrity but can be easily adjusted if necessary. This may seem like a hopeless endeavour at first but there are multiple examples of banking apps and the likes that do explicitly support GrapheneOS.
In the meantime there are some edge cases to keep in mind that may apply to your situation:
Some apps are configured in such a way that the Play Integrity check happens in the Google Play Store ("This app will not work for your device.") but not within the app itself. They may ultimately run if you install them through the Aurora Store, which lets you circumvent this type of restriction. eBay is such an example.
In some rare cases an app may be misconfigured and accept receiving no verdict at all as a permitted outcome. You can bring about this state by blocking the app's usage of the Play Integrity API.
Settings ➔ Apps ➔ App in question ➔ Advanced ➔ Play Integrity API ➔ Block usage attempts
4. Miscellaneous fixes
This is a list of peculiar fixes that apply to a subset of otherwise incompatible apps.
An app may:
- only run in the owner profile,
- dislike certain other installed apps which can include apps installed from anywhere but the Google Play Store,
- whitelist certain keyboard apps or require the default one to be active.