Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I decompiled the White House's new app

thereallo.dev

Post reply on HN
Print view View original

221–230 of 291 posts

Re: I decompiled the White House's new app

#221

Post by nucleardog »

ceejayoz wrote: post #99
hvb2 wrote: post #81

Earlier quoted context omitted.

That is a wild claim. I can't imagine that being correct given how that's been abused in the past https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att...

It's a pretty huge list. https://support.apple.com/en-us/126047 The chances of zero of these CAs having been compromised by state-level actors seems… slim. Do you trust "Hongkong Post Root CA 3" not to fuck with things? Your link's from 2011; the US government was still in the trusted list until 2018. https://www.idmanagement.gov/implement/announcements/04_appl...

All modern browsers require certificates to be published in the certificate transparency logs in order to be considered valid.

These are monitored, things do get noticed[0], and things like this can and have lead to CAs being distrusted.

It's not foolproof, and it's reactive rather than proactive... but in general, this is unlikely to be happening on major sites or at any significant scale.

I'd wholeheartedly recommend people taking some time and reading through the CA Compliance issues on Bugzilla. The entire CA program there, in my opinion, does a fantastic and largely thankless job of keeping this whole thing on the rails. It's one of the few things I can say I had _more_ trust in the more I looked into it.

[0]: https://bugzilla.mozilla.org/show_bug.cgi?id=1934361

Re: I decompiled the White House's new app

#222

Post by robin_reala »

gdeglin wrote: post #159

OneSignal cofounder here. Posting since our service was mentioned in this article. For those concerned or curious about location data collection, we wrote an explanation of how it works: https://onesignal.com/blog/youre-in-control-how-location-act...

We do not sell user data. Period.

You’ll sell it if you sell your company (as per your privacy policy).[1]

We may disclose or transfer your personal information in connection with, or during negotiations of, any acquisition of our business, financing or similar transaction.

If you wouldn’t sell it, period, then I’d suggest amending your privacy policy to include irrevocable deletion of customer data at the point your company is sold to a buyer.

[1] https://onesignal.com/privacy_policy

Re: I decompiled the White House's new app

#223

Post by SecretDreams »

robin_reala wrote: post #222
gdeglin wrote: post #159

OneSignal cofounder here. Posting since our service was mentioned in this article. For those concerned or curious about location data collection, we wrote an explanation of how it works: https://onesignal.com/blog/youre-in-control-how-location-act...

We do not sell user data. Period. You’ll sell it if you sell your company (as per your privacy policy).[1] We may disclose or transfer your personal information in connection with, or during negotiations of, any acquisition of our business, financing or similar transaction. If you wouldn’t sell it, period, then I’d suggest amending your privacy policy to include irrevocable deletion of customer data at the point your…

I would love to see a response to this comment from the OP.

Re: I decompiled the White House's new app

#224

Post by kevincox »

greenchair wrote: post #133
r4indeer wrote: post #14

The argument regarding no certificate pinning seems to miss that just because I might be on a network that MITM's TLS traffic doesn't mean my device trusts the random CA used by the proxy. I'd just get a TLS error, right?

that argument also misses because it is based on old best practices which are no longer relevant.

Certificate pinning can be useful, especially in particularly sensitive areas. But I wouldn't expect it as a standard security practice. If anything I appreciate that it isn't done so that reverse engineers can thoroughly study the traffic on their own devices. I agree that it was odd that the article mentioned it more than a quick note, let along made a big deal out of it.

Re: I decompiled the White House's new app

#225

Post by lukewarm707 »

nine_k wrote: post #45

> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls. So at least it does something actually beneficial for the user! I wish it could go even further, the way Reader Mode in a browser would go.

i downloaded the app but it doesn't let you use the browser. i thought it was the white house doing something helpful for once and giving us some internet freedom. alas.

Re: I decompiled the White House's new app

#226

Post by lukewarm707 »

drnick1 wrote: post #149

> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls. I wouldn't run a non-free government app on my phone, but this seems a positive. It's basically what uBlock does.

there is no browser in the app.

Re: I decompiled the White House's new app

#227

Post by [deleted] »

trimethylpurine wrote: post #84
kevinsync wrote: post #35

Earlier quoted context omitted.

Using somebody's stuff is different than hot-linking directly to a hosted version of it, even just from the perspective that dude could delete it at any time and break the whole app.

That's fair. I download and embed, personally. Still, it's not a rant worthy mistake, honestly. Suggest a better approach, sure.

[deleted]

Re: I decompiled the White House's new app

#228

Post by 2Gkashmiri »

crumpled wrote: post #166
Groxx wrote: post #50

Earlier quoted context omitted.

The permissions snippet they show also doesn't include location, and you can't request location at runtime at all without declaring it there. I'd verify all this stuff for myself, but Play won't install it in my phone so I can't really get the APK. Maybe because I use Graphene...? but I don't know all the ways they can restrict it, maybe it's something else (though for a pixel 9a it's rather strange if it's hardware…

If you use Aurora Store instead of the Play store, you can download APKs. They are a Google Play store proxy.

I have many apps that refuse to work. They try to open play store app which does not have logged in account.

The app doesn't work

Re: I decompiled the White House's new app

#229

Post by lukewarm707 »

rendx wrote: post #34
trimethylpurine wrote: post #13

I don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find something malicious in the random GitHub repo? If so, you should write an article about that instead.

I don't know if you're being serious or not, but in case you are: There is a difference between (re)using other people's open sourced code, hopefully reviewed, and giving anyone in control of the third party repository the ability to run arbitrary code on your user's devices. Even if the "random GitHub repo" doesn't contain any malicious code right now, it may well contain some tomorrow.

even open source is not that trustworthy.

there are several corpo open source ai apps that have rce built in.

to cut a long story short they pull their config from the developer's server on startup. that config has user level permissions giving rce.

some have no rce but get remote executed exfiltration of all the prompts. the app pulls its posthog config on startup and can just take all the keyboard inputs.

submit a disclosure and they do nothing or accuse of 'ai slop reports' despite being vibe coded themselves

Re: I decompiled the White House's new app

#230

Post by giwook »

SecretDreams wrote: post #223
robin_reala wrote: post #222

Earlier quoted context omitted.

We do not sell user data. Period. You’ll sell it if you sell your company (as per your privacy policy).[1] We may disclose or transfer your personal information in connection with, or during negotiations of, any acquisition of our business, financing or similar transaction. If you wouldn’t sell it, period, then I’d suggest amending your privacy policy to include irrevocable deletion of customer data at the point your…

I would love to see a response to this comment from the OP.

Same. OP will likely ignore it though.
Post reply on HN