Discussion
Loading...

Post

Log in
  • About
  • Code of conduct
  • Privacy
  • About Bonfire
Dwight Silverman
Dwight Silverman
@dsilverman@threads.net  ·  activity timestamp 2 weeks ago

This person decompiled and examined the code in the White House's new "official" app for iOS and Android. (It looks like they used the Android app.) "Alarming" is a good word for what was found.

https://blog.thereallo.dev/blog/decompiling-the-white-house-app

It's a detailed breakdown of the code. The summary for the less technically inclined:

May be an image of text that says 'official White House Android JavaScript into every website you open walls, signup walls, Has prompts, in-app browser paywalls. GPS tracking pipeline compiled syncing hide cookie that polls every minutes Loads JavaScript from person's GitHub Pages that account compromised, arbitrary code runs the app's foreground and the sandboxing. JavaScript Elfsight Sends email addresses static CDN Mailchimp, social Has this served Uploadcare, government infrastructure. certificate pinning. Standard Android trust management. Ships with dev artifacts Truth Social embed hardcoded Compose production. localhost Profiles extensively notification interaction logging, SMS client, and illegal? message tracking, and full user state observation. from official app? Probably'
May be an image of text that says 'official White House Android JavaScript into every website you open walls, signup walls, Has prompts, in-app browser paywalls. GPS tracking pipeline compiled syncing hide cookie that polls every minutes Loads JavaScript from person's GitHub Pages that account compromised, arbitrary code runs the app's foreground and the sandboxing. JavaScript Elfsight Sends email addresses static CDN Mailchimp, social Has this served Uploadcare, government infrastructure. certificate pinning. Standard Android trust management. Ships with dev artifacts Truth Social embed hardcoded Compose production. localhost Profiles extensively notification interaction logging, SMS client, and illegal? message tracking, and full user state observation. from official app? Probably'
May be an image of text that says 'official White House Android JavaScript into every website you open walls, signup walls, Has prompts, in-app browser paywalls. GPS tracking pipeline compiled syncing hide cookie that polls every minutes Loads JavaScript from person's GitHub Pages that account compromised, arbitrary code runs the app's foreground and the sandboxing. JavaScript Elfsight Sends email addresses static CDN Mailchimp, social Has this served Uploadcare, government infrastructure. certificate pinning. Standard Android trust management. Ships with dev artifacts Truth Social embed hardcoded Compose production. localhost Profiles extensively notification interaction logging, SMS client, and illegal? message tracking, and full user state observation. from official app? Probably'
Thereallo

I Decompiled the White House's New App

The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes, and loads JavaScript from some guy's GitHub Pages.
  • Copy link
  • Flag this post
  • Block

Bonfire social

This is a bonfire demo instance for testing purposes

bonfire.klasse-methode.it: About · Code of conduct · Privacy ·
Bonfire social · 1.0.2-rc.1 no JS en
Automatic federation enabled
Log in
Instance logo
  • Explore
  • About
  • Code of Conduct