Pixel Camera works fine. It doesn't require Google Play, but the functionality dependent on Google Play and AR Services does work fine on GrapheneOS via sandboxed Google Play.
You can install it via the sandboxed Play Store. Trying to install it via Aurora Store won't work properly unless you set the proper device model.
Google Pay doesn't allow NFC payments on an OS that's not certified by Google. It checks via Play Integrity. You can use a Pixel Watch with GrapheneOS to work around this since the Pixel Watch with the stock OS can make NFC payments itself without the OS on the phone needing to be Google certified. This is not a technical issue but rather a regulation issue. Play Integrity is absolutely not a real security feature but rather part of enforcing Google's licensing system which is presented as a way to defend against tampering with apps. In reality, it's very easy to bypass the device integrity mode via spoofing but not in a way that's suitable for a production quality OS which needs to keep working. It serves the purpose of stopping people using Google Pay and a subset of banking apps with a more secure OS but doesn't stop people using it with a much less secure OS where they're using one of the implementations of spoofing the checks. It's unfortunate. We support for Android's more meaningful hardware-based attestation but app developers need to whitelist GrapheneOS. It's covered at https://grapheneos.org/articles/attestation-compatibility-gu... for app developers, but we haven't yet made a big push to get some of them to do this. It's highly unlikely that Google Pay would do it without the EU saying they must.
Some banks have their own contactless payment app, which can be set as default in GrapheneOS (or any Android). Most banking apps work, as long as they use AOSP's hardware attestation feature instead of Google's SafetyNet, which requires the same Google device certification as GPay.
Some comments were deferred for faster rendering.
asdp9iujaspid|2 years ago
Google Pay will not work as GrapheneOS makes no attempt to masquerade as a Google-Certified device [0]
[0] https://grapheneos.org/usage#banking-apps
Suffocate5100|2 years ago
strcat|1 year ago
You can install it via the sandboxed Play Store. Trying to install it via Aurora Store won't work properly unless you set the proper device model.
Google Pay doesn't allow NFC payments on an OS that's not certified by Google. It checks via Play Integrity. You can use a Pixel Watch with GrapheneOS to work around this since the Pixel Watch with the stock OS can make NFC payments itself without the OS on the phone needing to be Google certified. This is not a technical issue but rather a regulation issue. Play Integrity is absolutely not a real security feature but rather part of enforcing Google's licensing system which is presented as a way to defend against tampering with apps. In reality, it's very easy to bypass the device integrity mode via spoofing but not in a way that's suitable for a production quality OS which needs to keep working. It serves the purpose of stopping people using Google Pay and a subset of banking apps with a more secure OS but doesn't stop people using it with a much less secure OS where they're using one of the implementations of spoofing the checks. It's unfortunate. We support for Android's more meaningful hardware-based attestation but app developers need to whitelist GrapheneOS. It's covered at https://grapheneos.org/articles/attestation-compatibility-gu... for app developers, but we haven't yet made a big push to get some of them to do this. It's highly unlikely that Google Pay would do it without the EU saying they must.
nani8ot|2 years ago
[1] https://grapheneos.org/usage#banking-apps
jstanley|2 years ago
I've never used Google Pay so I don't know.