Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We intercepted the White House app's network traffic

atomic.computer

Post reply on HN
Print view View original

51–60 of 85 posts

Re: We intercepted the White House app's network traffic

#51

Post by john_strinlai »

43% (of the 158 3rd-party requests) is... google. youtube, fonts, and analytics. 55% if you include facebook and twitter.

a government app shouldnt have crazy analytics and tracking and whatever. but i dont think loading google fonts or embedding youtube videos is really all that wild in the grand scheme of things.

given the title, i was half expecting some sort of egregious list with, like, palantir and some ICE domains or something. i dont like the app, but google? facebook? that is pretty boring.

the title probably should focus on nature/severity of the requests. titling it with a % of all requests feels bait-y if google/facebook/twitter isnt off in its own category. they have all sorts of dumb little requests to all sorts of domains that really inflate the numbers.

(as a note, atomic.computer also loads analytics and google fonts. which is whatever. but if they are going to imply 3rd-party requests are inherently bad just by nature of being 3rd-party, they may want to clean their own house a little bit.)

edit: original title at the time of my comment was "We intercepted the White House app's traffic. 77% of requests go to 3rd parties"

Re: We intercepted the White House app's network traffic

#52

Post by jmalicki »

amazingman wrote: post #9
jmalicki wrote: post #6

Earlier quoted context omitted.

The government should outsource way more of their traffic to third parties than a business should, since the government is inefficient, right?

Poe's Law strikes again. I legitimately can't tell if this is sarcasm.

It is sarcasm. I always get screwed by Poe's law, since dry sarcastic parodies of extremist views is one of my favorite methodologies for producing humor.

Re: We intercepted the White House app's network traffic

#53

Post by _heimdall »

Don't get me wrong, the government requires a high level of scrutiny.

I would be interested to see how this compares to industry standard though, 77% doesn't seem outrageous to me given all the trackers and advertising code I've seen over the years. It wouldn't surprise me if this is inline with many apps people install and don't think twice about.

Re: We intercepted the White House app's network traffic

#54

Post by [deleted] »

_heimdall wrote: post #53

Don't get me wrong, the government requires a high level of scrutiny. I would be interested to see how this compares to industry standard though, 77% doesn't seem outrageous to me given all the trackers and advertising code I've seen over the years. It wouldn't surprise me if this is inline with many apps people install and don't think twice about.

[deleted]

Re: We intercepted the White House app's network traffic

#55

Post by pratyushsood »

Government apps should absolutely be held to a higher standard than consumer B2C apps. Loading Google Fonts is one thing — sending telemetry to OneSignal and Facebook from an official government app is a different conversation entirely.

In Australia, apps handling government data must comply with the PSPF (Protective Security Policy Framework) and the ISM, which explicitly restrict data flows to untrusted third parties. A government app routing 77% of requests externally would fail an IRAP assessment on day one.

The fix is straightforward: self-host fonts, use first-party analytics, and treat every external request as a data exfiltration vector. Government digital teams know how to do this — the question is whether anyone is actually reviewing the network behavior post-deployment

Re: We intercepted the White House app's network traffic

#56

Post by DonHopkins »

SpicyLemonZest wrote: post #44
longislandguido wrote: post #38

Earlier quoted context omitted.

[flagged]

What's the point of lying like this? You know and I know that Trump would not take it in good humor if a CEO or politician posted a video of themselves pooping on him. Nor would you take it in good humor if your boss posted a video of themselves pooping on you. There's just nothing humorous about it.

It's pointless to take anything longislandguido says seriously, since he actually does have Trump Derangement Syndrome as evidenced by his deranged lies on Trump's behalf.

Re: We intercepted the White House app's network traffic

#57

Post by JumpCrisscross »

pratyushsood wrote: post #55

Government apps should absolutely be held to a higher standard than consumer B2C apps. Loading Google Fonts is one thing — sending telemetry to OneSignal and Facebook from an official government app is a different conversation entirely. In Australia, apps handling government data must comply with the PSPF (Protective Security Policy Framework) and the ISM, which explicitly restrict data flows to untrusted third parti…

> Government apps should absolutely be held to a higher standard than consumer B2C apps

Honestly—why? What is in this traffic that mandates heightened scrutiny? It strikes me as simply about brand.

Re: We intercepted the White House app's network traffic

#58

Post by userbinator »

merek wrote: post #43

> We installed mitmproxy on a Mac, configured an iPhone to route traffic through it, and installed the mitmproxy CA certificate on the device. > All HTTPS traffic was decrypted and logged. No modifications were made to the traffic. The app was used as any normal user would use it. Is it really that simple to inspect network traffic on an iPhone, namely to get it to trust the user-installed cert? I do quite a bit of n…

Regardless, it highlights the importance of having control of our own devices, including the ability to easily inspect network traffic. We have the right to know where our data is being sent, and what data is being sent.

Meanwhile I've always found it amusing that there's a loud, probably corporate-owned/Big-Tech-brainwashed subset of the "security" crowd who complains about MITM proxies.

Re: We intercepted the White House app's network traffic

#59

Post by chirau »

gruez wrote: post #48
chirau wrote: post #40

Earlier quoted context omitted.

It's the government, the US government. By far the largest employer and spender in the world. So yes, they are held to a higher standard. Businesses intentionally throttle customer service lines for profit reasons. The government should not. How is this difficult to understand?

>So yes, they are held to a higher standard. See my earlier comment about how this is a meaningless platitude. >Businesses intentionally throttle customer service lines for profit reasons. The government should not. None of this was presupposed in the original comment, only that wait times are long.

what the hell do you mean meaningless platitude? Do you understand the difference between civic duty and corporate duty?

If a company proactively evades taxes for profit, do you give the government the same pass? Companies skate and fight all this through litigation and interpretation. The government's duty is to the people and to uphold the law, not fight it. They are held to a higher standard of law, accountability and practice in all undertakings. What exactly are you refuting here?

Re: We intercepted the White House app's network traffic

#60

Post by funman7 »

cedws wrote: post #45
merek wrote: post #43

> We installed mitmproxy on a Mac, configured an iPhone to route traffic through it, and installed the mitmproxy CA certificate on the device. > All HTTPS traffic was decrypted and logged. No modifications were made to the traffic. The app was used as any normal user would use it. Is it really that simple to inspect network traffic on an iPhone, namely to get it to trust the user-installed cert? I do quite a bit of n…

Installing the CA requires jumping through some hoops, but yes, intercepting traffic for apps that don’t use cert pinning isn’t that difficult on iOS. Apps that do use cert pinning is a whole other matter, I’ve tried unsuccessfully a few times to inspect things like banking apps. Needs a rooted device at the minimum.

So I assume the white house app doesn’t do cert pinning

Also looked into this a long time ago… could someone tell me how to do this with cert pinned apps ?

Post reply on HN