I decompiled the White House's new app • Hacker News Board

Re: I decompiled the White House's new app

#21

Post by flutas » Sat, Mar 28, 2026, 4:43 PM UTC

crtasm wrote: post #10

colesantiago wrote: post #6

Earlier quoted context omitted.

> Even in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account. You'd be surprised how many apps inside have hacks and workarounds because deadlines.

Let's see if anyone can give an example of such a high profile app doing something similar.

I've worked on a three letter sports orgs (one of NFL, NBA, NHL, etc) Android app.

I always joke that we could probably tell you what color and type your underwear is on any random day with how much data is siphoned off your phone.

As for loading random JS, yeah also seen that done that before. "Partner A wants to integrate their SDK in our webviews." -> "Partner A" SDK is just loading a JS chunk in that can do whatever they want in webviews, including load more files.

Don't get me started on the sports betting SDKs...

Though we do have a Security team constantly scanning SDKs and the endpoints for changes in situations like this.

Re: I decompiled the White House's new app

#22

Post by ThaFresh » Sat, Mar 28, 2026, 4:44 PM UTC

nice work, so they can get your location and have ICE scoop you up if required

Re: I decompiled the White House's new app

#23

Post by iancarroll » Sat, Mar 28, 2026, 4:48 PM UTC

A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article.

I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a commonly invoked function.

Re: I decompiled the White House's new app

#24

Post by p2detar » Sat, Mar 28, 2026, 4:53 PM UTC

r4indeer wrote: post #18

thegagne wrote: post #15

Earlier quoted context omitted.

Not if you are part of an org that uses MDM and pushes their own CA to devices.

Ok, fair point. However, I would consider any MDM-enabled device fully "compromised" in the sense that the org can see and modify everything I do on it.

An MDM orga cannot install a trusted CA on non-supervised (company owned) devices. By default on BYOD these are untrusted and require manual trust. It also cannot see everything on your device - certainly not your email, notes or files, or app data.

Re: I decompiled the White House's new app

#25

Post by post-it » Sat, Mar 28, 2026, 4:55 PM UTC

> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls.

Rare Trump administration W. I'm assuming there's one particular website they open in the app that shows a cookie popup, and this was a dev's heavy-handed way of making that go away.

Re: I decompiled the White House's new app

#26

Post by longislandguido » Sat, Mar 28, 2026, 4:57 PM UTC

[flagged]

Re: I decompiled the White House's new app

#27

Post by imalerba » Sat, Mar 28, 2026, 5:01 PM UTC

somehnguy wrote: post #8

Interesting. The site is nearly unusable to me unfortunately. '19 MBP w/ Chrome - scrolling stutters really bad

Scrolling is so laggy it's annoying to follow on mobile (FF 151.0a1)

Re: I decompiled the White House's new app

#28

Post by jasonlotito » Sat, Mar 28, 2026, 5:02 PM UTC

flutas wrote: post #21

crtasm wrote: post #10

Earlier quoted context omitted.

Let's see if anyone can give an example of such a high profile app doing something similar.

I've worked on a three letter sports orgs (one of NFL, NBA, NHL, etc) Android app. I always joke that we could probably tell you what color and type your underwear is on any random day with how much data is siphoned off your phone. As for loading random JS, yeah also seen that done that before. "Partner A wants to integrate their SDK in our webviews." -> "Partner A" SDK is just loading a JS chunk in that can do whate…

> As for loading random JS, yeah also seen that done that before.

Partner A is not random JS. The assumption there is 1) you have some official signed agreement with them and 2) you've done your due diligence to ensure you can use them in this way.

It's not just some person's GH repo who can freely change that file to whatever they want.

Hotlinking is as old as the internet, and a well-worn security threat.

Re: I decompiled the White House's new app

#29

Post by dijksterhuis » Sat, Mar 28, 2026, 5:06 PM UTC

iancarroll wrote: post #23

A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article. I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a co…

what version are you on?

from the iphone app store: version 47.0.1 - minor bug fixes - 34 minutes ago

while the parent posted 18 minutes ago

they may have patched the location stuff as part of the “minor bug fixes”?

Re: I decompiled the White House's new app

#30

Post by frizlab » Sat, Mar 28, 2026, 5:10 PM UTC

iancarroll wrote: post #23

A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article. I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a co…

> it doesn't request location permissions anywhere, despite the claims in the article

The article does not claim the app requests the location. It claims it can do it with a single JS call.