Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I decompiled the White House's new app

thereallo.dev

Post reply on HN
Print view View original

71–80 of 291 posts

Re: I decompiled the White House's new app

#71

Post by torstenvl »

rendx wrote: post #34
trimethylpurine wrote: post #13

I don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find something malicious in the random GitHub repo? If so, you should write an article about that instead.

I don't know if you're being serious or not, but in case you are: There is a difference between (re)using other people's open sourced code, hopefully reviewed, and giving anyone in control of the third party repository the ability to run arbitrary code on your user's devices. Even if the "random GitHub repo" doesn't contain any malicious code right now, it may well contain some tomorrow.

Completely agree. This is really unique. Can you imagine if it were standard practice to be open to supply chain attacks like that, by blindly relying on hotlinked or unpinned dependencies?

Re: I decompiled the White House's new app

#73

Post by paulhebert »

longislandguido wrote: post #60
mattdeboard wrote: post #57

Earlier quoted context omitted.

Are you upset people are being critical of a shabbily run government program?

[flagged]

Is this not a government program? Did someone in the cabinet choose to do this?

I’d prefer they not release shoddily build propaganda apps

Re: I decompiled the White House's new app

#74

Post by wincy »

trimethylpurine wrote: post #64
xocnad wrote: post #32

Earlier quoted context omitted.

And when the app links off to an EU site? Nothing prevents an EU user from using this app. There are a variety of Trump enthusiasts, though I suspect less than there are here in the US.

I think they just fine the entity doing business in the EU. If they don't do business there, I can't see any issues. I'm not an attorney, but I don't find any cases that extend beyond that.

Quite honestly, it’d be hilarious to see the clown car response from the White House if some EU bureaucrats tried to enforce their GDPR rules on the White House though. “Lol Make us” is the nicest response I can guess at.

Re: I decompiled the White House's new app

#75

Post by wincy »

analog31 wrote: post #59

[flagged]

Every default setup on every website and app for the last five or so years has been encouraging users to add pronouns, making it difficult to avoid it, even my iPhone asks me to add each person’s pronouns when I add a new contact. I don’t know why Siri needs to know that, but it’s there. There’s one website I use that won’t let you sign up as a contributor without “completing your profile”, which includes mandatory pronouns.

I guess there’s some workplaces where it’d be useful for me to update these, probably the ones Apple PMs work in.

Re: I decompiled the White House's new app

#77

Post by kevin_thibedeau »

subscribed wrote: post #63
r4indeer wrote: post #14

The argument regarding no certificate pinning seems to miss that just because I might be on a network that MITM's TLS traffic doesn't mean my device trusts the random CA used by the proxy. I'd just get a TLS error, right?

Not if someone can issue the certificate signed by the CA your phone trust. Imagine being in a cafe nearby, say, embassy of the certain north African country known for pervasive and wide espionage actions, which decides to hijack traffic in this cafe. Or imagine living in the country where almost all of the cabinet is literally (officially) being paid by the propaganda/lobbying body of such country. Or living int he…

Israel is not in Africa.

Re: I decompiled the White House's new app

#78

Post by Groxx »

david_allison wrote: post #49
dmitrygr wrote: post #43

Earlier quoted context omitted.

> The article does not claim the app requests the location. It claims it can do it with a single JS call. so can ... any other code anywhere on a mobile device? That is how API work...

You need to state the permissions you *may* request/use in AndroidManifest.xml. This data can then be displayed to users pre-installation. From the (limited) article, it doesn't seem they do this: https://thereallo.dev/blog/decompiling-the-white-house-app#p... ---- EDIT: I'm mistaken. From the Play Store[0] it has access to * approximate location (network-based) * precise location (GPS and network-based) [0] https://…

What version do you see? 47.0.1 doesn't have that for me: https://news.ycombinator.com/item?id=47557033

Re: I decompiled the White House's new app

#79

Post by Galanwe »

layer8 wrote: post #67
subscribed wrote: post #63

Earlier quoted context omitted.

Not if someone can issue the certificate signed by the CA your phone trust. Imagine being in a cafe nearby, say, embassy of the certain north African country known for pervasive and wide espionage actions, which decides to hijack traffic in this cafe. Or imagine living in the country where almost all of the cabinet is literally (officially) being paid by the propaganda/lobbying body of such country. Or living int he…

> Imagine being in a cafe nearby, say, embassy of the certain north African country known for pervasive and wide espionage actions, which decides to hijack traffic in this cafe. How would they get your phone to trust their CA? Connecting to a Wi-Fi network doesn’t change which CAs a device trusts.

Because there is a quadrillion trusted CAs in every device you might use. A good chunk of these CAs have been compromised at one point or another, and rogue certificates are sold in the dark market. Also any goverment can coerce a domiciled CA to issue certs for their needs.

Re: I decompiled the White House's new app

#80

Post by charcircuit »

SoftTalker wrote: post #11

Looks like what you might expect in a standard marketing app from a consultancy. They probably hired someone to develop it, that shop used their standard app architecure which includes location tracking code and the other stuff.

And r8 which does tree shaking to remove dead code is not smart enough to understand react native so it won't strip it out without extra work from the developer.

Cross referencing these different things in the article to other apps that exist was my first thought as these seem pretty generic and probably reused from somewhere else.

Post reply on HN