10 ms·
I decompiled the White House's new app
- colesantiago 7mo agoThis is a pretty standard decomplation of an Android app. I am sure if you decompile other apps used by hundreds of thousands of people, you would find all sorts of tracking in there. Thanks for helping the White House improve their app security for free though.
- yellow_lead 7mo agoEven in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account.
- colesantiago 7mo ago> Even in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account. You'd be surprised how many apps inside have hacks and workarounds because deadlines.
- crtasm 7mo agoLet's see if anyone can give an example of such a high profile app doing something similar.
- flutas 7mo agoI've worked on a three letter sports orgs (one of NFL, NBA, NHL, etc) Android app. I always joke that we could probably tell you what color and type your underwear is on any random day with how much data is siphoned off your phone. As for loading random JS, yeah also seen that done that before. "Partner A wants to integrate their SDK in our webviews." -> "Partner A" SDK is just loading a JS chunk in that can do whatever they want in webviews, including load more files. Don't get me started on the sports betting SDKs... Though we do have a Security team constantly scanning SDKs and the endpoints for changes in situations like this.
- jasonlotito 7mo ago> As for loading random JS, yeah also seen that done that before. Partner A is not random JS. The assumption there is 1) you have some official signed agreement with them and 2) you've done your due diligence to ensure you can use them in this way. It's not just some person's GH repo who can freely change that file to whatever they want. Hotlinking is as old as the internet, and a well-worn security threat.
- -retardando- 7mo ago> you won't find us loading arbitrary JS from a random GitHub user's account You load arbitrary JS from a random GitHub user's NPM package. What's the difference?
- gitaarik 7mo agoTrue for any random game app in the Play store, and flashlight and note apps. But well reputable companies don't put too much weirdness into their apps.
- Arainach 7mo ago"An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls." In their defense, this is the first thing the Trump admin has done that's unambiguously positive for ordinary people.
- ronsor 7mo agoYes, this is a major UX improvement considering I remove those with uBlock Origin anyway.
- subscribed 7mo agoIndeed. I'd love it somehow taken out of it and made available for the general public. Custom uBlock / Adblock filers will be probably the easiest.
- flexagoon 7mo agouBlock's built in filters handle it just fine, since it's very basic blocking based on html classes of the elements
- shimman 7mo agoI too love it when US imperialism invades digital spaces, just ignore how the US treats people critical of its own government (not just referring to the Trump admin here) then yeah sure great. Let me know when this can ignore malware/adware from US companies then I'll give accolades.
- gitaarik 7mo agoYeah it's great, we can actually let go of these silly open source projects like uBlock Origin, and just rely on the government for protecting us against the dangerous web!
- oefrha 7mo ago> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls. Giving people a taste of web with Ublock Origin annoyance filters applied, refreshing. Can’t believe orange man regime is doing one thing right.
- somehnguy 7mo agoInteresting. The site is nearly unusable to me unfortunately. '19 MBP w/ Chrome - scrolling stutters really bad
- catlikesshrimp 7mo agoNot what you meant, but works fine on Firefox 148.0.2 (Build #2016148295), 15542f265e9eb232f80e52c0966300225d0b1cb7 GV: 148.0.2-20260309125808 AS: 148.0.1 OS: Android 14
- imalerba 7mo agoScrolling is so laggy it's annoying to follow on mobile (FF 151.0a1)
- KomoD 7mo agoDoes it for me too, chrome on a thinkpad
- beAbU 7mo ago> chrome on a thinkpad This is akin to saying "browser on a computer". Need to be more specific.
- tredre3 7mo agoScrolling is extremely poorly behaved on that page for me too, Firefox 149 Windows 10. Which is quite ironic coming from an article that mainly criticizes the web dev aspects of the app!
- Aerolfos 7mo agoScrolling on my firefox is smooth... with javascript blocked.
- amarcheschi 7mo agoI agree, the website of the original article is kinda terrible
- 7mo ago
- vineyardmike 7mo ago> The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes (9.5m when in background), and loads JavaScript from some guy's GitHub Pages (“lonelycpp” is acct, loads iframe viewer page). Doesn’t seem too crazy for a generic react native app but of course coming from the official US government, it’s pretty wide open to supply chain attacks. Oh and no one should be continually giving the government their location. Pretty crazy that the official government is injecting JavaScript into web views to override the cookie banners and consent forms - it is often part of providing legal consent to the website TOS. But legal consent is not their strong suit I guess.
- trimethylpurine 7mo agoAren't the banners for EU page visitors. I don't think there is a US law about this, is there?
- xocnad 7mo agoAnd when the app links off to an EU site? Nothing prevents an EU user from using this app. There are a variety of Trump enthusiasts, though I suspect less than there are here in the US.
- az09mugen 7mo agoPlease don't give them ideas.
- subscribed 7mo agoThey conduct a pervasive, hidden, persistent user tracking not only without consent, looking at the analysis, but also stripping the user from a chance of declining tracking on other sites. I'm quite sure that's illegal.
- trimethylpurine 7mo agoWhich federal law would be relevant here? I'm only aware of California and EU laws that might be. But, I'm fairly certain they don't apply to the US government because of several Constitutional and international laws superseding. I'm not sure. If there is an attorney to answer that would be interesting.
- sitzkrieg 7mo agoi assumed it was malware out the gate. yep
- SoftTalker 7mo agoLooks like what you might expect in a standard marketing app from a consultancy. They probably hired someone to develop it, that shop used their standard app architecure which includes location tracking code and the other stuff.
- charcircuit 7mo agoAnd r8 which does tree shaking to remove dead code is not smart enough to understand react native so it won't strip it out without extra work from the developer. Cross referencing these different things in the article to other apps that exist was my first thought as these seem pretty generic and probably reused from somewhere else.
- miki123211 7mo agoThe Polish covid quarantine app was famously adapted from some app for store inspectors or something, as it already implemented most of the required functionalities, like asking for photos via push at random times, sending them along with a location etc. They likely did a search-and-replace on the brand name, so you had strings like 'your invoices from Home Quarantine inc' in the code. Not a bad thing per se, getting the app out the door asap was definitely a priority in that project for understandable reasons, but funny nonetheless.
- jclardy 7mo agoThe location tracking code is within the OneSignal SDK - which is just a standard messaging platform for sending emails/push messages to users. It doesn't have some magical permissions bypass, the app itself has to request it.
- halJordan 7mo agoThat's exactly what 45Press is. They won a 1.5mil contract to spit out this tripe (tbf the contract includes other wh.gov support).
- DonHopkins 7mo ago
- trimethylpurine 7mo agoI don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find something malicious in the random GitHub repo? If so, you should write an article about that instead.
- xocnad 7mo agoAll good for you to make those choices for yourself. Your response seems to be show ignorance of all the recent supply chain attacks that have occurred. You can imagine that given the situation with the shoe gifts that many high up members of the administration and cabinet members are running this app.
- trimethylpurine 7mo agoI'm critical of the author. I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting. The supply chain attack articles are interesting exactly because this is so common. So what's special here other than it being loosely related to a disliked political figure? HN isn't supposed to be an especially political website. "A common app is doing the same thing that basically every other app is doing." Is that a good headline? No. And this isn't a good article.
- xocnad 7mo ago> I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting. It's an article that includes coverage of the exposure to supply chain attacks, mainly via directly linking in https://lonelycpp.github.io/react-native-youtube-iframe/iframe_v2.html https://lonelycpp.github.io/react-native-youtube-iframe/ifra.... You seem to be flippantly dismissing this as insignificant given the people who are probably running this app. > HN isn't supposed to be an especially political website. Yes but when technology and politics cross paths...
- 7mo ago
- r4indeer 7mo agoThe argument regarding no certificate pinning seems to miss that just because I might be on a network that MITM's TLS traffic doesn't mean my device trusts the random CA used by the proxy. I'd just get a TLS error, right?
- thegagne 7mo agoNot if you are part of an org that uses MDM and pushes their own CA to devices.
- r4indeer 7mo agoOk, fair point. However, I would consider any MDM-enabled device fully "compromised" in the sense that the org can see and modify everything I do on it.
- p2detar 7mo agoAn MDM orga cannot install a trusted CA on non-supervised (company owned) devices. By default on BYOD these are untrusted and require manual trust. It also cannot see everything on your device - certainly not your email, notes or files, or app data.
- somebudyelse 7mo agoAs someone who has an MDM-managed device, I beg to differ. Although, this one uses newer style android MDM, which involves factory resetting and doing special things during OOBE. Even if it used the older style, nothing's stopping the app for requesting file access, notification access, etc. and not working until you grant the permissions.
- Melatonic 7mo agoAndroid has multiple options for MDM - the mess invasive one has a completely separate work profile that should not give the org that kind of access.
- replwoacause 7mo agolol honestly all of this tracks given the current administration. i'm actually surprised it isn't worse. but yeah, amateur hour for sure.
- jfengel 7mo ago"Amateur hour" is basically their theme. They were swept in on a wave of distrust for people who know what they're talking about. They were elected to tear down Chesterton's fence, even (and especially) the parts holding in the face-eating leopards. To mix the metaphors further, they (the politicians and their supporters) fancy themselves the kind to dream of things that never were and ask why not. Why not have a war in Iran? You won't know until you give it a try.
- ThaFresh 7mo agonice work, so they can get your location and have ICE scoop you up if required
- iancarroll 7mo agoA bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article. I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a commonly invoked function.
- dijksterhuis 7mo agowhat version are you on? from the iphone app store: version 47.0.1 - minor bug fixes - 34 minutes ago while the parent posted 18 minutes ago they may have patched the location stuff as part of the “minor bug fixes”?
- deleted 7mo ago[deleted]
- filoleg 7mo agoI have the iOS version from yesterday, haven't updated the app yet. No location permission request prompting encountered. In system settings, where each app requesting location data is listed, it isn't present either.
- SV_BubbleTime 7mo agoAh. So another way to say it doesn’t get your location every 4 seconds.
- croes 7mo agoIsn’t it useless to talk about the iOS version if the article is about the Android app?
- frizlab 7mo ago> it doesn't request location permissions anywhere, despite the claims in the article The article does not claim the app requests the location. It claims it can do it with a single JS call.
- post-it 7mo ago> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls. Rare Trump administration W. I'm assuming there's one particular website they open in the app that shows a cookie popup, and this was a dev's heavy-handed way of making that go away.
- longislandguido 7mo ago[flagged]
- rpdillon 7mo agoNah, I suspect any app that's loading arbitrary JS from somebody's random GitHub page would get called out for that behavior. We're getting supply chain attacks daily.
- tclancy 7mo agoThat is some impressive willful ignorance. “If it was anybody else threatening to beat this guy up for what he was saying, you’d probably praise them. But a cop does it one time and …”
- mattdeboard 7mo agoAre you upset people are being critical of a shabbily run government program?
- longislandguido 7mo ago[flagged]
- paulhebert 7mo agoIs this not a government program? Did someone in the cabinet choose to do this? I’d prefer they not release shoddily build propaganda apps
- goosejuice 7mo agohttps://45press.com/ https://45press.com/ would be my guess.
- mattdeboard 7mo agoUh, yeah, dude, when Whitehouse.gov announces its new app, the app is a government program. Hope this helps but something tells me it won't.
- andix 7mo agoI would've expected worse. :)
- somebudyelse 7mo agoThe only permissions on the play store are notifications. On data privacy, it only shows optional email or phone number. Respectfully, I call BS.
- nine_k 7mo ago> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls. So at least it does something actually beneficial for the user! I wish it could go even further, the way Reader Mode in a browser would go.
- lukewarm707 7mo agoi downloaded the app but it doesn't let you use the browser. i thought it was the white house doing something helpful for once and giving us some internet freedom. alas.
- jruz 7mo agoIs this a surprise to anyone?
- ranzhh 7mo agoAre those references to 45 and 47 "Easter Eggs" to Trump's presidency number(s)? As in, forty-five-press (45th president) and Version 47.x.x (47th president), as well as the text message hotline (45470).
- analog31 7mo ago[flagged]
- wincy 7mo agoEvery default setup on every website and app for the last five or so years has been encouraging users to add pronouns, making it difficult to avoid it, even my iPhone asks me to add each person’s pronouns when I add a new contact. I don’t know why Siri needs to know that, but it’s there. There’s one website I use that won’t let you sign up as a contributor without “completing your profile”, which includes mandatory pronouns. I guess there’s some workplaces where it’d be useful for me to update these, probably the ones Apple PMs work in.
- 4ndrewl 7mo agoIt's often useful for me so that I can know how to address you/refer to you, especially if it's a foreign (to me) name I'm unfamiliar with.
- array_key_first 7mo agoI would imagine it would be useful in 100% of English-speaking workplaces because all workplaces have the expectation of English communication, which pronouns are essential for. If I'm writing an email or a chat message, I will typically have to use a pronoun. Inferring pronouns has always been dumb and annoying. Many names don't have obvious pronouns, for example, the name "Taylor". Is that he or she? And clicking the little profile icon and squinting to see if someone is a man or a woman is also a waste of time. It's a lot easier for everyone if it just tells you the pronoun.
- vdqtp3 7mo ago> If I'm writing an email or a chat message, I will typically have to use a pronoun. It's not that hard to just avoid it. I send emails to a lot of people I haven't spoken to and don't know their gender, so I write gender-neutral emails.
- iam_circuit 7mo ago[dead]
- crimshawz 7mo ago[flagged]
- pugchat 7mo ago[dead]
- periodjet 7mo ago[flagged]
- mmastrac 7mo agoYou omitted these items immediately above that line: Injects JavaScript into every website you open through its in-app browser to hide cookie consent dialogs, GDPR banners, login walls, signup walls, upsell prompts, and paywalls. Has a full GPS tracking pipeline compiled in that polls every 4.5 minutes in the foreground and 9.5 minutes in the background, syncing lat/lng/accuracy/timestamp to OneSignal's servers. Loads JavaScript from a random person's GitHub Pages site (lonelycpp.github.io) for YouTube embeds. If that account is compromised, arbitrary code runs in the app's WebView. Loads third-party JavaScript from Elfsight (elfsightcdn.com/platform.js) for social media widgets, with no sandboxing. Sends email addresses to Mailchimp, images are served from Uploadcare, and a Truth Social embed is hardcoded with static CDN URLs. None of this is government infrastructure. Has no certificate pinning. Standard Android trust management. Ships with dev artifacts in production. A localhost URL, a developer IP (10.4.4.109), the Expo dev client, and an exported Compose PreviewActivity. Profiles users extensively through OneSignal - tags, SMS numbers, cross-device aliases, outcome tracking, notification interaction logging, in-app message click tracking, and full user state observation.
- periodjet 7mo ago[flagged]
- mmastrac 7mo ago> It’s hard to imagine a smug article like this dissecting a product of some other administration Did the other administration put a "fake news" and "report to ICE" and grifting link to their own social network in their apps? I feel like you are perhaps papering over a whole lot of general shittiness of this app that didn't exist in less amateur previous administrations that at least tried to follow the norms.
- 7mo ago
- razkaplan 7mo ago[flagged]
- verteu 7mo ago> Don't post generated comments or AI-edited comments. HN is for conversation between humans. https://news.ycombinator.com/newsguidelines.html#generated https://news.ycombinator.com/newsguidelines.html#generated
- enigmaTest 7mo ago[flagged]
- OrangeMusic 7mo ago"yappy yappy"? What?
- 1e1a 7mo agoThis website is quite GPU intensive when scrolling.
- reactordev 7mo agoViolating the law is what the White House is all about these days.
- wnevets 7mo ago> That's a personal GitHub Pages site. If the lonelycpp GitHub account gets compromised, whoever controls it can serve arbitrary HTML and JavaScript to every user of this app, executing inside the WebView context. I was promised a meritocracy and non stop winning. When do those begin?
- julianlam 7mo agoThis site makes my browser choke. Reader mode was the only thing that made it readable.
- ray_v 7mo agoI was looking for this comment - it makes my browser choke as well! I thought it was just my tablet, but interesting that others see that too.
- alcor-z 7mo ago[dead]
- AnonyMD 7mo agoIf this is true, it would be a symbolic event marking the disappearance of freedom, a source of pride for the United States.
- herbst 7mo agoThis. Definitely not the moment you voted the same bullshit AGAIN expecting anything else than the end of the US as we all know it.
- drnick1 7mo ago> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls. I wouldn't run a non-free government app on my phone, but this seems a positive. It's basically what uBlock does.
- lukewarm707 7mo agothere is no browser in the app.
- mikey_p 7mo agoExcept the app isn't a browser, doesn't advertise this feature and hides it from it's users.
- orthogonalinfo 7mo ago[flagged]
- gdeglin 7mo agoOneSignal cofounder here. Posting since our service was mentioned in this article. For those concerned or curious about location data collection, we wrote an explanation of how it works: https://onesignal.com/blog/youre-in-control-how-location-actually-works-in-onesignals-sdk/ https://onesignal.com/blog/youre-in-control-how-location-act...
- exogeny 7mo ago[flagged]
- nclin_ 7mo agoDead link
- Anonasty 7mo agoWorks for me.
- lumpo 7mo agoThe onesignal domain is on the IPFire Domain Blocklist Found 1 list exactly matching 'onesignal.com': - https://dbl.ipfire.org/lists/ads/domains.txt block list added: 2026-02-13 15:00:20 last modified: 2026-02-13 15:00:20 last updated: 2026-03-29 04:02:16 (126.625 domains) enabled, used in 1 group comment: "IPFire Advertising" matching entries: - onesignal.com
- rerdavies 7mo agoBump this please. This should be the #1 comment.
- jcmartinezdev 7mo agoEven though those pop ups and paywalls are annoying, you shouldn’t be injecting custom CSS and JS like that. It’s just wrong. And the location… well, if one day they need you, they’ll sure be glad they know your each steps and current location . It’s not a bug, it’s a feature.
- nguyendinhdoan 7mo ago[dead]
- ssyhape 7mo ago[flagged]
- Shank 7mo agoAlso with something as high profile as this, it could also be a politically motivated actor just sabotaging it out of spite.
- ChicagoDave 7mo agoI prefer my state-sponsored propaganda raw without tracking me.
- Factomega 7mo ago[flagged]
- kaluga 7mo ago[dead]
- krisakma 7mo ago[dead]