I decompiled the White House's new app

#1

Post by amarcheschi » Sat, Mar 28, 2026, 3:37 PM UTC

I decompiled the White House's new app
thereallo.dev

Re: I decompiled the White House's new app

#2

Post by colesantiago » Sat, Mar 28, 2026, 4:07 PM UTC

This is a pretty standard decomplation of an Android app.

I am sure if you decompile other apps used by hundreds of thousands of people, you would find all sorts of tracking in there.

Thanks for helping the White House improve their app security for free though.

Re: I decompiled the White House's new app

#3

Post by Arainach » Sat, Mar 28, 2026, 4:09 PM UTC

"An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls."

In their defense, this is the first thing the Trump admin has done that's unambiguously positive for ordinary people.

Re: I decompiled the White House's new app

#4

Post by yellow_lead » Sat, Mar 28, 2026, 4:10 PM UTC

colesantiago wrote: post #2

This is a pretty standard decomplation of an Android app. I am sure if you decompile other apps used by hundreds of thousands of people, you would find all sorts of tracking in there. Thanks for helping the White House improve their app security for free though.

Even in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account.

Re: I decompiled the White House's new app

#5

Post by oefrha » Sat, Mar 28, 2026, 4:10 PM UTC

> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls.

Giving people a taste of web with Ublock Origin annoyance filters applied, refreshing. Can’t believe orange man regime is doing one thing right.

Re: I decompiled the White House's new app

#6

Post by colesantiago » Sat, Mar 28, 2026, 4:11 PM UTC

yellow_lead wrote: post #4

colesantiago wrote: post #2

This is a pretty standard decomplation of an Android app. I am sure if you decompile other apps used by hundreds of thousands of people, you would find all sorts of tracking in there. Thanks for helping the White House improve their app security for free though.

Even in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account.

> Even in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account.

You'd be surprised how many apps inside have hacks and workarounds because deadlines.

Re: I decompiled the White House's new app

#7

Post by ronsor » Sat, Mar 28, 2026, 4:12 PM UTC

Arainach wrote: post #3

"An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls." In their defense, this is the first thing the Trump admin has done that's unambiguously positive for ordinary people.

Yes, this is a major UX improvement considering I remove those with uBlock Origin anyway.

Re: I decompiled the White House's new app

#8

Post by somehnguy » Sat, Mar 28, 2026, 4:13 PM UTC

Interesting. The site is nearly unusable to me unfortunately. '19 MBP w/ Chrome - scrolling stutters really bad

Re: I decompiled the White House's new app

#9

Post by vineyardmike » Sat, Mar 28, 2026, 4:15 PM UTC

> The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes (9.5m when in background), and loads JavaScript from some guy's GitHub Pages (“lonelycpp” is acct, loads iframe viewer page).

Doesn’t seem too crazy for a generic react native app but of course coming from the official US government, it’s pretty wide open to supply chain attacks. Oh and no one should be continually giving the government their location. Pretty crazy that the official government is injecting JavaScript into web views to override the cookie banners and consent forms - it is often part of providing legal consent to the website TOS. But legal consent is not their strong suit I guess.

Re: I decompiled the White House's new app

#10

Post by crtasm » Sat, Mar 28, 2026, 4:17 PM UTC

colesantiago wrote: post #6

yellow_lead wrote: post #4

Earlier quoted context omitted.

Even in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account.

> Even in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account. You'd be surprised how many apps inside have hacks and workarounds because deadlines.

Let's see if anyone can give an example of such a high profile app doing something similar.