yashsingh1/xdaforums huggingface dataset:
[Magisk] HippoMan:
More info: I now realize that the activated payment methods are stored in this database:

/data/data/com.google.android.gms/databases/android_pay

This database gets altered as soon as I perform any GPay functions. I tried copying the android_pay DB to /sdcard after activating the payment methods, and then I manually copyied it back to /data/data/com.google.android.gms/databases and chowned it properly right before performing any GPay operations. However, this DB gets overridden right at moment I do anything in GPay.

I also set its permissions to 440, but then GPay says that it cannot access payment methods.

This means that the android_pay DB gets initialized from some other unknown source when GPay runs.

There also is a pay DB in that same directory, and it contains a payment_methods table which lists all the payment methods. However, this pay DB doesn't contain any info about the activation status of these payment methods. The android_pay DB seems to be the place where that activation status info resides. Also, the pay DB doesn't get altered.

So ... something (??? what ???) writes to the android_pay DB as soon as any GPay operations take place. Soon after activating payment methods, a row for each activated payment method gets written. But after 10-20 minutes, the android_pay DB gets cleared each time GPay operations take place, and it then contains no rows.

Does anyone have any insights about the internals of GPay, so I could perhaps determine what is the source of the data that always gets written into the android_pay DB? That data source is what loses track of the activation status of my payment methods.
[Magisk] pndwal:
A 'token' from issuing bank is stored on device for each card.

Re. Google Pay tokenization infrastructure

"Customer tokenizes card: A customer adds their card to Google Pay. Then, their mobile device stores a payment token that is encrypted using a limited / single-use key."

-'Detailed Google Pay transaction process in stores', point 1:

https://support.google.com/pay/merchants/answer/6345242?hl=en PW
[Magisk] HippoMan:
Thank you. But GPay remembers the payment methods (PayPal and two credit cards in my case). The list of payment methods never disappears. All three of these payment methods work fine when I am making purchases from the Play Store. They never disappear from that list of available payment methods. Also, they never disappear from the list of available payment methods within GPay. This implies that the tokens for these items remain unchanged on my device.

However, what GPay does not remember is the list of payment items that are enabled for contactless payment. I can activate these, and for a short time, they all show up as being available for contactless payment (i.e., a visual representation of each "card" is shown to me in GPay, and I can choose between them and then make purchases).

But as I have explained, all of these disappear from the contactless payment list after 10-20 minutes, and this occurs at exactly the same instant. This implies that the removal of these items from the contactless payment list is not being done by the financial institutions themselves (since obviously, all of these financial instituions don't coordinate their respective access to GPay on my device with each other). Rather, it's clear that Google is the entity which always chooses to simultaneously remove all these items from the contactless payment list 10-20 minutes after I activate them on this list.

And again, even when they are removed from the contactless payment list, these items remain in my list of available payment methods in GPay and Play Store. This allows me to quickly re-enable each of them in GPay for contactless payment. When I do so, this procedure repeats: i.e., every 10-20 minutes, all of them disappear simulteneously from the contactless payment list, yet again.

Even though SafetyNet passes, GPay is runnable, and root is not detected by GPay and other apps, it's almost as if Google remembers that some time in the past, my device was visibly rooted from their point of view, and so now, they periodically query my device and always remove all contactless payment methods, irrespective of the fact that root is currently not detectable on my device. I don't know if this is what is actually occurring, but it seems like it might be.
[Magisk] HippoMan:
I now have an idea of what might be causing my issue with items always being removed from my contactless payment list. I always use Swipe Lock on my device, and I only enable Pin Lock before running GPay. After running GPay, I do a force-kill on the GPay app and go back to Swipe Lock.

I just now realized that Google can query my device and determine whether it is using a screen lock. If I go to Google's "Security Checkup" screen for the Google account that I use on my device, it tells me that screen lock needs to be disabled on my device. This means that Google can and does periodically query my device to determine the screen-lock status.

My guess is that when Google queries my device and detects that I am running with Swipe Lock, it goes and removes all contactless payment methods from the GPay list, even when GPay is not running. I can't test this hypothesis now, but I will do so later today or tomorrow.

If this is indeed what Google does, that gives me an even stronger motivation to give up completely on GPay. I'll report my findings about this in a day or so.
[Magisk] 73sydney:
Umm PIN lock is a requirement, wouldnt even have thought to ask, because thats expressly mentioned when you set up G Pay...
[Magisk] HippoMan:
But whenever I run GPay, pin lock is enabled. Keep in mind that GPay won't even start up without a screen lock being enabled.

My conjecture here is that Google might be going out of their way (1) to periodically check our devices to see if screen locking is disabled, and (2) if it's indeed disabled, to then remove all contactless payment settings, even if GPay is not running.

If so, then that would totally unhelpful and needlessly painful ... and I would be totally ungrateful to Google.

I hope that my conjecture is false.
[Magisk] 73sydney:
You do realise that device security is not applied by google on a "when you feel like it" basis?

Of course its going to be enforced. We are just trying to keep our heads above water trying to keep GPay working

Youre actively taking sips :)
[Magisk] 73sydney:
@pndwal

In other news, i got to the store today and i can tell you 2 things:

1) GPay worked a treat! (with as mentioned above when i set up, no MagiskHide on GPay)

and i found this out because

2) Samsung Pay failed on my Active 2 - it said payment completed, but then card declined. At which point i got my Pixel out and used G Pay :). When i got home i cranked up chat with Westpac and they got no declined activity on my account or there backend for my card. So may just be an isolated incident. I didnt feel like trying a billionty times at the store as i had a line behind me....
[Magisk] HippoMan:
My device security and my financial security are my responsibility.

If indeed my above-mentioned conjecture is true (and we don't know whether it actually is), then Google would be very much overstepping, IMO.

Other security efforts that Google continues to undertake are already overblown, and this is why we have to keep working increasingly harder to keep our heads above water.

The inconvenience level of Android is fast approaching that of iOS.
[Magisk] HippoMan:
UPDATE: I just discovered that my conjecture is false; i.e., Google apparently is *not* checking the screen lock status of our devices and then removing contactless payment capabilities when screen lock is disabled.

In an ongoing dialog that I've been having with a Google customer service rep about this issue, I was just told that Google doesn't do that.

Also, to test my hypothesis, I've been keeping my pin lock enabled, and after 10-20 minutes, my contactless payment items have now disappeared.

So, Google is off the hook on this one.
[Magisk] 73sydney:
You're starting to sound like you'd be better off joining the MicroG crowd, who think theyre somehow legends because they dont use Google (expect of course most of them still do for GCM) :)

You can try to keep enforcing what you think are your rights, or just get on with life, like the rest of us, here in reality :)
[Magisk] HippoMan:
That's a bit of a straw-man argument. I'm not taking such an extreme position.

The purpose of this thread is to discuss ways to work around Google's excessive security regarding GPay and SafetyNet. Much of the current work in Magisk is also for the purpose of bypassing overbearing SafetyNet restrictions.

If Google would do anything to make contactless payment items disappear in the name of "security" when we are not running GPay and screen lock happens to be turned off, then I would want to bypass those restrictions, as well, in my efforts to take responsibility for my own financial security in my own way.

And as I mentioned above, Google's representative recently claimed to me that Google is not doing this w/r/t contactless payments, and I'm glad.
[Magisk] 73sydney:
Youre having a philosophical argument in a thread where we already have a proven working practical method.

The two are not going to be compatible...

When youre the only person ever to have this issue, then by rights one has to assume its something you have done on your device. We've already been at this from every angle we have, and then some.
[Magisk] HippoMan:
I'm trying to understand why I have this issue, and I have always been certain that it is being caused by something I'm doing on my device which is not interacting positively with Google's software. As I mentioned, the Google customer service person I've been communicating with has stated that Google does not clear the contactless payment list when I don't even run GPay but when screen lock is set to "Swipe". Therefore, the cause of my issue is still a mystery to me. I want to find out what I'm doing so that I can correct it or work around Google's procedures ... or else to just abandon GPay if the remedy turns out to require me to stop using my device in other ways that I desire.

As for my tangential personal opinions about Google's security policies, they are indeed off topic, but no more so than some of the completely-non-GPay-related conversations that certain other people seem happy to engage in here from time to time.

I thought that this thread would be an appropriate place for me to try to gain the understanding I'm seeking about how to solve my mystery and correct my GPay issue, but it now seems like I have been mistaken about this.

I apologize for what I have been bringing to this thread.
[Magisk] 73sydney:
im just pointing out things were veering off course, is all...and given we'd already talked about Xposed and other things we suspect might cause the issue, theres not much else we can practically suggest, since youre patient #1 with the issue

i wish i had something better to tell you or suggest :)
[Magisk] HippoMan:
Thank you for your comment.

I came to this thread because I thought this was likely to be a forum where there would be participants who are willing to work together and to supportively try to help each other solve issues that are related to the theme of the thread. However, since my problem doesn't involve anything that the GPay.SQLite.Fix addresses, I haven't experienced that kind of supportive attitude very much here.

Therefore, I don't see any reason for me to continue to come here any more to discuss the various steps that I'm taking to try to rectify my issue.

However, if I do end up solving my "mystery", I'll come back one more time to post whatever it is that I will have learned, in case it might help someone else who comes here in the future with a similar problem.
[Magisk] 73sydney:
Dude, we've given you as much help as we can, over many posts and tried to be light hearted about it, unless youre claiming the pics of my bear are too distressing :)

You cant seriously claim we havent tried to help...
[Magisk] 73sydney:
@pndwal

Slightly OT, but made my first successful payment via Samsung Pay on my Active 2 today. Second attempt, dont know why the 1st one failed the other day, probably touchy terminal
[Magisk] pndwal:
Mate, I for one sincerely hope you solve it, and will be happy to hear what the ailment was when you get a diagnosis. Also, if I had anything useful to contribute, I would certainly comment. I don't at present, but I have considered your informative posts.

What is ot or ot is clearly subjective, as I noted in the Magisk discussion thread recently (and only you thanked 👍)...

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-84624671

I personally have no problem with abstract but related issues in these threads, as long as the op is ok with it (seems op's kept out of this one), or even some inside jokes / banter. Others might, but op is the real arbiter. I find focussed conjecture and speculation can be quite informative and useful, so i don't think you need apologise.

FWIW, many on XDA have strong opinions on corporate Google (I've noted yours), and not a few Devs are pro microG / /e/ foundation. While discussion can be emotive it is edifying all the same, and both sides of the argument have merit.

Kind regards, PW
[Magisk] Lord Sithek:
Does Google Pay or Google Services search for Magisk Manager? For the second time recently Safety Net failed suddenly for me (both cts and basic integity). But when I hid Magisk Manager and rebooted (without clearing anything) SafetyNet passed again. But GPay remembered failed state obviously and refused to work. Maybe I should hide MM at the first place, thats why Im asking :)
[Magisk] 73sydney:
As I'm now running my Active 2 watch and it hates any trace of magisk, I've gotten into the habit after a clean flash of enabling magiskhide, then hiding magisk manager (usually set to rename to M), then Airplane mode on, clear data on Google Play and Play Services, reboot, Airplane off, check Play Store is certified, and then start working on GPay....
[Magisk] Lord Sithek:
Id rather prefer not to clear Play Services since it clears my WearOS app as well and I have to set it up again and connect to the watch. And it probably messes with GCM, so Id like to avoid that. But whenever GPay detects root, I have no choice... :confused:
[Magisk] HippoMan:
Thank you very much!

I have always felt that your responses have been informative, thoughtful, intelligent respectful, and helpful to myself and everyone else, both here and in the other forums in which I have read your posts. My issues here have nothing to do with you.

This is the first time I've come back here in a couple weeks. I thought I'd come by to see if anyone might have also encountered the same problem that I have, and if so, perhaps solved it. But sadly, that is still not the case.

I have had an open issue with Google support about this for the past 2-3 weeks, and they still have not been able to solve it. Once every 5-7 days, I get a message like this from them:

> We are still looking into your issue and checking with our product experts. I'll give you an update in 24-48 hours.

That is the latest message from them, and it arrived a couple days ago. However, they have never come back within that 24-48-hour time frame.

I'll check back here in a couple weeks or so ... or sooner if I end up with a cure for my GPay ailment that I can report.

Thank you again.
[Magisk] 73sydney:
Dude, your one man campaign to try and bend Google to your will not end well

Your posts have been wildly off topic for some time, and dont contribute to the topic,

as literally everyone else accepts that a screen lock is part of secure payments.

Even my Samsung watch insists on a screen lock for Samsung Pay

For a very good reason: security

Its a security feature that if you follow logic is completely sane

I'll say it again, youre debating your ideology, not advancing the topic of the thread...

Youre better suited to shouting your own personal outrage at Google into the void over the MicroG cult threads

Here you go: https://xdaforums.com/t/app-microg-...ftware-clone-of-google-play-services.3217616/

Stop posting the same idealogical argument, take it to Google in private, for the love of god
[Magisk] HippoMan:
Calm down and take a few breaths, then re-read my previous message, this time, more slowly and carefully. There is no outrage. Just technical details of how GPay works for me and a comment about Goggle's slowness in responding to my ticket about my issue.

There have been thousands of person-hours spent in working to bypass another one of Google's security mechanisms, namely SafetyNet. Do you call that effort "outrage"? I am just trying to do the same thing with this particular Google security mechanism.

I have determined that it's likely that removing Screen Lock, even when GPay is not running, will cause the contactless payment list to be cleared. That is the likely cause of my problem.

And because of this, I have decided to not use GPay.
[Magisk] pndwal:
Yes, seems the data / card info is cleared when screenlock is removed, clearly on server end first, and seems for good reason.

Eg:

https://support.google.com/googlepay/answer/10189798?co=GENIE.Platform=Android&hl=en

So there's the rub; This security will certainly be negated if phone is lost with screenlock disabled.

Not only will a thief be able to open / use GPay, but will likely be able to disable your ability to use Google Find my Phone to remotely find, lock, or erase device, allowing them to continue using GPAY at least till financial institutions are alerted (and, in fact, compromising ALL data on device). Disabled screen lock triggering card detail removal / GPay reset is the solution.

Google also states clearly

https://support.google.com/pay/answer/7644132

Intetestingly, this doc also states:

But it seems these use extra security features with specific requirements:

https://support.google.com/pay/answer/7625055?hl=en&ref_topic=7625138

A number of institutions confirm the above security (screen lock disabled) behaviour. Eg, Card details will be removed from the Google Pay app if:

https://www.westpac.com.au/faq/android-pay-card-removed/

Of course, this is all general G Pay usage criteria, and not related to Magisk root use specifically. 🤠 PW
[Magisk] HippoMan:
Yes, I had overlooked the fact that someone who steals my unlocked device can enable a screen lock and then use GPay. Thank you very much helping me realize this. Of course, if someone steals my wallet, he or she could use my NFC-enabled credit cards just as easily, and I'm perfectly happy to be living with this risk.

One way around this would be for us to have the option for the GPay password to be the same as the password we use for our Google account, without any screen locking in this case. This would then work similarly to how we purchase paid apps from the Play Store. However, I don't expect that capability to be added any time soon by Google.

In any case, I do not want to use GPay enough to always have to use a screen-locked device. There are alternatives to GPay that can be used for contactless payment which I am more comfortable with most of the time, anyway.

So this indeed explains and resolves my issue ... with the resolution being my decision to not use GPay.

If some time in the future we are compelled by circumstances to only use mobile-device-based contactless payment, I might have to revise this decision. But I don't see that happening any time soon.
[Magisk] HippoMan:
Although until I realized this, I wasn't sure if something related to Magisk or any of its modules might have been causing or contributing to my problem, and that was one of the things I was trying to investigate. Keep in mind that it was specifically suggested here that I look into all my Magisk modules (among other things), to see if any of these items might be the cause of my issue. If I indeed found that one or more Magisk modules were responsible (and I did investigate this and did not find any such Magisk modules), my posting that finding here would certainly have been helpful to other Magisk-users who might have GPay problems.

Anyway, now that I know that this isn't related in any way to Magisk, it is all the more reason for me to stop posting here.
[Magisk] 73sydney:
Dude, i think you should take your own advice on this one, and calm down.

You have complained about this ad nausem and threatened to not use GPay for weeks

You’ve been told you will not change the existing security policy by Google to suit you, one person, several times

Please just stop using it, and let this thread return to topic

Stop flouncing...for the love of god
[Magisk] pndwal:
Interestingly, while I found the statement "To help protect your information in case your phone gets lost or stolen, the Google Pay app requires a screen lock" fairly easily, I couldn't find anything from the big G re. card details being removed from the Google Pay app if the security control (screen lock etc) is removed. I did find this stated repeatedly by Banks offering GPay however.

This affirms my guess that these standards have been / are a collaborative effort to provide best / reasonable security at a time when I think we all acknowledge nefarious schemes, abuse, fraud, theft, scams, and wanton oportunism are defining our age, and banking institutions themselves are battling this.

My guess is that if Google were to downgrade their security measures, they would either have to guarantee / make good losses incurred, or lose their G Pay (Big Bank) partners...

My gut feeling is that we are only going to see MORE security. 😐

Personally, I'm enjoying using G Pay on a rooted device while it lasts... and I don't expect that to be yonks. PW
[Magisk] 73sydney:
Thanks for all the research/justification
[Magisk] CSX321:
I've tried to find this info, but maybe I've overlooked it. I've put off switching to the new Pay, since the old one has still been working. I use it daily, and I don't want to screw up my working phone/Magisk/Pay setup. I also have a lot of loyalty cards, etc. stored, so it would be a pain to have to clear data and set all that back up.

So, is anything special needed to switch to the new Pay without losing anything? Do I need to download the new app and turn on airplane mode while I make sure it's hidden with Magisk Hide?
[Magisk] 73sydney:
Ive personally never had an issue just updating Google Pay as normal....ymmv
[Magisk] CSX321:
I haven't had a problem updating the app normally, either. But I want to make sure it's okay to let it update to the *new* Pay, which is a different app (and different package ID I assume).
[Magisk] 73sydney:
ahh, got you, i havent been presented with the new one yet, but ive just looked it up on apkmirror...got you, different app

ill install it manually and get back to you

update:

I can install but not run it...its geo dependent

Will only allow users in the following to run it:

India

Singapore

United States

See pic:

Sorry, i cant even test it for you :(

Looks like one of those staged rollouts google are famous for
[Magisk] CSX321:
I decided to dive in and try it. No issues. The new one is called GPay (com.google.android.apps.nbu.paisa.user). I don't know if it was needed, but I checked it in Magisk Hide anyway. I was able to add a payment card and make a purchase with no problem. All my loyalty cards and other data looks like it transferred over, as well.
[Magisk] 73sydney:
cheers for being the guinea pig and allowing others to upgrade without fear

songs may not be sung in your honour, but your sacrifice has been noted...

have a good day
[Magisk] phly95:
I've added all my cards to Google pay except Discover, which for some reason keeps saying "Something went wrong, please try again." I'm using an Essential PH-1 on StatixOS v4.2 (Android 11). I suspect that Discover is implementing an additional layer of security above Google's. I was able to add it to my Android wear watch, but not my phone itself.
[Magisk] CSX321:
Do you have the Discover app checked in Magisk Hide? I do, and I use my Discover all the time with Pay, although I originally added it to Pay years ago.