Possible workaround solutions

Purpose: Utilize as a reference permalink for consistent citing on duplicates across platforms. E.g.,

Important announcements
Banking app compatibility with GrapheneOS
Possible workaround solutions
Next steps
- Problematic applications
- Not compatible

Important announcements

December 1, 2023 – Compatibility of Banking Apps with GrapheneOS

PLEASE READ: Twitter / Nitter | Mastodon | Bluesky

If you receive a warning from your banking app indicating that your device may be insecure, jailbroken, or rooted, this is usually due to the SafetyNet/Play Integrity API. Specifically, your device fails to pass MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY.

As of now, there are no direct solutions available to users. However, you can help by contacting your bank. Inform them of this issue and suggest they refer to the GrapheneOS Attestation Compatibility Guide for their developers, available here: Attestation Compatibility Guide.

For more details, see the planned feature on this topic at the GrapheneOS issue tracker: Issue #1986.

Banking app compatibility with GrapheneOS

To submit, view, and/or track international banking apps compatibility with GrapheneOS, please use this issue-tracker.

A 3rd party community-sourced effort containing banking app compatibility information is maintained by PrivSec.dev. GrapheneOS does not make any guarantees regarding the list's validity.

Possible workaround solutions

1. Native code debugging

By default, native code debugging is enabled. If you disabled it, try enabling it again. Launch app.
If unsuccessful, proceed to step 2.

Settings ➔ Security ➔ Enable native code debugging

2. Exploit protection compatibility mode

Enable the per-app exploit protection compatibility mode. Launch app.
If unsuccessful, proceed to step 3 for testing only.

Settings ➔ Apps ➔ AppName ➔ Advanced ➔ Exploit protection compatibility mode

Turning on the exploit protection compatibility toggle reduces system security but may allow this application to run without crashing. The app crashed because GrapheneOS detected a memory corruption bug that may be exploitable by an attacker.

3. Secure app spawning

3.1 - Temporarily disable secure app spawning.

Setting ➔ Security ➔ Enable secure app spawning

3.2 - Restart device. Launch app to see if this GrapheneOS feature caused the compatibility issue. The app may be refusing to run if it detects a different spawning mechanism.

Significant security loss and directly affecting some privacy using Zygote

Disabling exec-based spawning reverts to using the traditional Zygote spawning model AOSP's app processes
Spawned as a clone of the Zygote
Each app process has the same random secrets for ASLR, SSP, memory tagging, pointer authentication, setjmp canaries, and heap randomization
Half of the userspace is made of app processes
Applies across all profiles
App in profile A and profile B have same random values, which they can see

3.3 - Revert to secure spawning by enabling it again and restart device.
See step 3.1 above.

4. Alternative frontend clients

Potential use of an unofficial/alternative Google Play Store frontend client may be problematic for misguided apps:

That can check if they were installed from the Play Store and can choose to refuse to work if they were not installed from the Play Store.
Some forbid usage on non-stock OS (most OSes are insecure)
May cause your Google Account to be disabled/blocked/blacklisted by Google.
Anonymous account usage may have negative consequences and have a less secure connection to the Play Store servers.

General recommendation: Install Sandboxed Google Play. Optionally use a throwaway account.

5. Searched the existing issues

Search the forum, os-issue-tracker, and/or within the community for keyword(s) specific to the app name.
If unsuccessful with finding a solution, only than proceed to step 6.

6. Capture a bug report

6.1 - Attempt to reproduce the issue by capturing a 'Bug report' using the feature in Developer options if you still run into the app aborting at launch.

Enable Developer option by tapping the 'Build number' 7 times
Settings ➔ About ➔ Device identifiers ➔ Build number
Capture a bug report
Settings ➔ System ➔ Developer options ➔ Bug Report ➔ Interactive report ➔ REPORT

6.2 - Alternatively, using logcat.
Exampe:

Prepare for reproduction
adb logcat -c to clear previous logs
Reproduce the issue
In a timely manner to avoid unecessary logs:
- adb logcat -d > issue.log to dump the logs in a file named issue.log

6.3 - Disable the developer options.

Settings ➔ System ➔ Developer options ➔ Use developer options

We recommend disabling developer options as a whole for a device that's not being used for app or OS development.

7. Submit a bug report

Open a new issue, provide a description and make contact via the appropriate channels with a similar message like "Bug report capture for issue #104". in order to submit the bug report capture zip privately. (Replace the issue # number).

Contacting the project
Reporting issues
Friendly reminder: instructions for getting support via chat and when to avoid using the os-issue-tracker: ask questions + request support

Next steps

Problematic applications

It's plausible that this is app-related, rather than a compatibility issue with GrapheneOS - acknowledging this factor must be considered. (Ref. 2568#issuecomment-1766887298)

Not compatible

Due to the deprecation of SafetyNet attestations, there is increasing changes among some apps on the Play Store to switch over to the new Play Integrity API. Consequently, some of these apps are known to set themselves as unavailable for devices that do not pass Play Integrity checks at various levels.

See View and restrict your app's compatible devices and Store listing visibility

Turn on integrity checks for your store listing so that Google Play can check that devices pass integrity checks before making your store listing visible to users.

This feature is primarily intended for use only by apps using the Play Integrity API. It aims to prevent users from encountering a poor experience by installing these apps, only to find they do not function properly on their devices.

Please see the Attestation compatibility guide on using remote attestation in a way that's compatible with GrapheneOS and how you can help.

GrapheneOS users are strongly encouraged to share this documentation with app developers enforcing only being able to use the stock OS. Send an email to the developers and leave a review of the app with a link to this information. Share it with other users and create pressure to support GrapheneOS rather than locking users into the stock OS without a valid security reason. GrapheneOS not only upholds the app security model but substantially reinforces it, so it cannot be justified with reasoning based on security, anti-fraud, etc.

Please read (December 1, 2023): Twitter / Nitter | Mastodon | Bluesky

Possible workaround solutions

Table of contents

Important announcements

Banking app compatibility with GrapheneOS

Possible workaround solutions

1. Native code debugging

2. Exploit protection compatibility mode

3. Secure app spawning

4. Alternative frontend clients

5. Searched the existing issues

6. Capture a bug report

7. Submit a bug report

Next steps

Problematic applications

Not compatible