PrivSec-dev / banking-apps-compat-report

Report and track banking app compatibility with GrapheneOS, including which workarounds may be required.
https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
83 stars 4 forks source link

Cash App #453

Closed bugQ closed 2 months ago

bugQ commented 4 months ago

Is there an existing issue for this?

App name

Cash App

Link to app

https://play.google.com/store/apps/details?id=com.squareup.cash

App version

4.49.0

Country of the app

United States

Build Number

2024052100

Device list

Pixel 8

Profile app tested in

Secondary profile(s)

Google Play installed?

Installed

Where did you install this app from?

Google Play Store

Google Play services Network permission revoked?

Native code debugging

Exploit protection compatibility mode

Memory tagging extension (MTE)

Stock OS compatibility

NFC payments

Description of the app's functionality

Attempts to log into an existing account are met with "We couldn't verify this account belongs to you", regardless of login method, including all of the methods available under "I need help logging in".

In situations like this, Cash App support recommends creating a new account and verifying ownership over live chat via the new account.

However, attempts to create a new account are met with "Cash App doesn't support the use of emulators or other software programs."

Are there any extra notes you think users should know about?

I have not exhausted all available combinations of OS settings yet. I may update this issue once I have.

ADB logcat of the app if necessary

No response

spring-onion commented 4 months ago

Play integrity might be knocking on the door here. Mind capturing some logs?

bugQ commented 4 months ago

Updated issue to reflect that I have now tested both with and without Exploit Protection Compatibility Mode.

Play integrity might be knocking on the door here. Mind capturing some logs?

Sure, I can try, hopefully soon.

spring-onion commented 3 months ago

A user reported it works if you revoke network access to all 3 Google Play components: Google Play services, Google Play Store, Google Services Framework.

bugQ commented 3 months ago

A user reported it works if you revoke network access to all 3 Google Play components: Google Play services, Google Play Store, Google Services Framework.

Interesting, glad somebody got it to work, tho I don't seem to be able to replicate this.

For diagnosing this issue, would logs from just the app be enough, or do you need them from Play Services as well, or the whole system ?

spring-onion commented 3 months ago

Try clearing the app storage too.

For logs, the app ones alone will do for now.

ThisNekoGuy commented 3 months ago

Ran into this issue when I migrated to GrapheneOS the other day; here's an app log:

Cash App log 14f72578fc80.txt

Screenshot: ![Screenshot_20240621-214302](https://github.com/PrivSec-dev/banking-apps-compat-report/assets/28468662/c48447fb-1736-4ef8-bdd8-0db1f11be58c)
spring-onion commented 3 months ago

@ThisNekoGuy Welcome! Have you tried the troubleshooting procedure I noted further up?

ThisNekoGuy commented 3 months ago

I saw it, but isn't revoking network access for those counterproductive (required) for literally every other app besides this one? I was hesitant about that "solution" when I read it :/

spring-onion commented 3 months ago

@ThisNekoGuy It's only a temporary measure, just to check. If it turns out it works you could shove it into a secondary profile to not disturb the regular flow in your primary one.

ThisNekoGuy commented 3 months ago

I just tried it and it didn't work. :/ Not sure how that other person managed that by doing it.