Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I decompiled the White House's new app

thereallo.dev

Post reply on HN
Print view View original

81–90 of 291 posts

Re: I decompiled the White House's new app

#81

Post by hvb2 »

Galanwe wrote: post #79
layer8 wrote: post #67

Earlier quoted context omitted.

> Imagine being in a cafe nearby, say, embassy of the certain north African country known for pervasive and wide espionage actions, which decides to hijack traffic in this cafe. How would they get your phone to trust their CA? Connecting to a Wi-Fi network doesn’t change which CAs a device trusts.

Because there is a quadrillion trusted CAs in every device you might use. A good chunk of these CAs have been compromised at one point or another, and rogue certificates are sold in the dark market. Also any goverment can coerce a domiciled CA to issue certs for their needs.

That is a wild claim. I can't imagine that being correct given how that's been abused in the past

https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att...

Re: I decompiled the White House's new app

#84

Post by trimethylpurine »

kevinsync wrote: post #35
trimethylpurine wrote: post #13

I don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find something malicious in the random GitHub repo? If so, you should write an article about that instead.

Using somebody's stuff is different than hot-linking directly to a hosted version of it, even just from the perspective that dude could delete it at any time and break the whole app.

That's fair. I download and embed, personally. Still, it's not a rant worthy mistake, honestly. Suggest a better approach, sure.

Re: I decompiled the White House's new app

#86

Post by mmastrac »

periodjet wrote: post #83

[flagged]

You omitted these items immediately above that line:

Injects JavaScript into every website you open through its in-app browser to hide cookie consent dialogs, GDPR banners, login walls, signup walls, upsell prompts, and paywalls.

Has a full GPS tracking pipeline compiled in that polls every 4.5 minutes in the foreground and 9.5 minutes in the background, syncing lat/lng/accuracy/timestamp to OneSignal's servers.

Loads JavaScript from a random person's GitHub Pages site (lonelycpp.github.io) for YouTube embeds. If that account is compromised, arbitrary code runs in the app's WebView.

Loads third-party JavaScript from Elfsight (elfsightcdn.com/platform.js) for social media widgets, with no sandboxing.

Sends email addresses to Mailchimp, images are served from Uploadcare, and a Truth Social embed is hardcoded with static CDN URLs. None of this is government infrastructure.

Has no certificate pinning. Standard Android trust management.

Ships with dev artifacts in production. A localhost URL, a developer IP (10.4.4.109), the Expo dev client, and an exported Compose PreviewActivity.

Profiles users extensively through OneSignal - tags, SMS numbers, cross-device aliases, outcome tracking, notification interaction logging, in-app message click tracking, and full user state observation.

Re: I decompiled the White House's new app

#87

Post by periodjet »

mmastrac wrote: post #86
periodjet wrote: post #83

[flagged]

You omitted these items immediately above that line: Injects JavaScript into every website you open through its in-app browser to hide cookie consent dialogs, GDPR banners, login walls, signup walls, upsell prompts, and paywalls. Has a full GPS tracking pipeline compiled in that polls every 4.5 minutes in the foreground and 9.5 minutes in the background, syncing lat/lng/accuracy/timestamp to OneSignal's servers. Load…

[flagged]

Re: I decompiled the White House's new app

#88

Post by trimethylpurine »

xocnad wrote: post #33
trimethylpurine wrote: post #13

I don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find something malicious in the random GitHub repo? If so, you should write an article about that instead.

All good for you to make those choices for yourself. Your response seems to be show ignorance of all the recent supply chain attacks that have occurred. You can imagine that given the situation with the shoe gifts that many high up members of the administration and cabinet members are running this app.

I'm critical of the author.

I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting.

The supply chain attack articles are interesting exactly because this is so common. So what's special here other than it being loosely related to a disliked political figure? HN isn't supposed to be an especially political website.

"A common app is doing the same thing that basically every other app is doing."

Is that a good headline? No. And this isn't a good article.

Re: I decompiled the White House's new app

#89

Post by Aerolfos »

tredre3 wrote: post #47
somehnguy wrote: post #8

Interesting. The site is nearly unusable to me unfortunately. '19 MBP w/ Chrome - scrolling stutters really bad

Scrolling is extremely poorly behaved on that page for me too, Firefox 149 Windows 10. Which is quite ironic coming from an article that mainly criticizes the web dev aspects of the app!

Scrolling on my firefox is smooth... with javascript blocked.

Re: I decompiled the White House's new app

#90

Post by mmastrac »

periodjet wrote: post #87
mmastrac wrote: post #86

Earlier quoted context omitted.

You omitted these items immediately above that line: Injects JavaScript into every website you open through its in-app browser to hide cookie consent dialogs, GDPR banners, login walls, signup walls, upsell prompts, and paywalls. Has a full GPS tracking pipeline compiled in that polls every 4.5 minutes in the foreground and 9.5 minutes in the background, syncing lat/lng/accuracy/timestamp to OneSignal's servers. Load…

[flagged]

> It’s hard to imagine a smug article like this dissecting a product of some other administration

Did the other administration put a "fake news" and "report to ICE" and grifting link to their own social network in their apps? I feel like you are perhaps papering over a whole lot of general shittiness of this app that didn't exist in less amateur previous administrations that at least tried to follow the norms.

Post reply on HN