kimwimgoddess
36166
918
18
https://blog.thereallo.dev/blog/decompiling-the-white-house-app
Mar 30, 2026 12:40 AM
kimwimgoddess
36166
918
18
https://blog.thereallo.dev/blog/decompiling-the-white-house-app
jaggcomputing5
Is anyone of this what you would expect from a government app? No, but from Trump and his paymasters/lackeys/jockeys/etc, yes
Shewy92
"Unparalleled Access to the Trump Administration"
There's apparently a typo there, should be *for the Trump Administration, not to.
battery1979
Who do they think will download this?
76000BatteryLlamas
SciFiGuy2018
Ok, now, how can we get Trump to download this to his phone...
belly42
Didn't he refuse to use the official government secured phone in term 1? I vaguely recall news articles saying the Chinese gov had hacked the phone he was using instead.
Donfolstar
Only the best people
Navrodel
...fucking WordPress? What year is it, 2012?
Rapbot20
In other words...avoid it that's what I'm hearing
GroovyCrowley
So it is basically exactly what you expect it to be.
Randomice
narcoleptiKnickers
Same with the Handmaid's Tale, but here we are now.
IHateTransphobes
The Handmaid's Tale was their plan before it was published.
Lugh314159
Guys, don't get too mad. 100% an AI wrote this code.
CabezaPlata
"Consent/Paywall Bypass Injector." Of course an app run by this administration tries doesn't give a fuck about consent.
IgnisInvictus
Oh this shit is just so bad. Wow.
I'm not surprised. I just hoped for better.
DarkZalgo
I mean I'm surprised they went with react native, that's just hot fucking garbage. You only use it for Android if you literally cannot find a developer that knows anything other than JavaScript.
immabearrawr
Sounds ripe for poison injections. I'm just speculating...
Gruesslibaer
This is one of those "no shit" type situations.
ajodin
Elfsight likely tied to Anduril in some way shape or form
syko2k
"Do not download the White House's new app"
As if anybody here had to be told not to do it.
HolyFreakingToast
WHAT? NO CRYPTO MINER?
AgamemnonsMemes
Honestly this surprised me too
HolyFreakingToast
would this be a good way to attack MAGA with a virus to route all requests for foxnews to pbs?
IbuProfanity
20 bucks say it’s vibe coded by a manosphere incel, lol.
nspriest233
But will it be the real trum or the A.I. Trum that you "have access to".
Blackfinity
What's insidious is that the Orange Infant is far too stupid to understand any of this. This is the "deep state" shit they made such a big deal about come to real life.
Khanamana324
Every single accusation a reactionary makes is always a confession.
iamthemurray
Why is government going out of its way to be its own national security risk. Mind boggling but expected I suppose
MajinHercule
Because the people apparently voted for a national security risk. That's democracy for you.
TheVillageGrouch9000
Surprise! Is iOS similar? A bit more locked down no?
LostCaterpillar
They only analyzed the android version but I'd assume so. Things like location are default denied on iOS unless you opt in while on android they are (or were last time I used it) default allowed but you could opt out.
What I find funny is that due to this difference some developers will spy more on android users than apple ones. Discord, for example, tracks your location on android but doesn't seem to on iOS.
TheVillageGrouch9000
When it came time to replace my dear old Windows Nokia phone I opted for Apple as it is the more secure platform. Google is imwo less trustworthy than Apple. I miss the Nokia.
Rage3
No, this isn't default allowed on Android. You get permission popups for every permission an app wants to use (even Google native apps).
LostCaterpillar
Then it's good that they changed it to match the apple model. One of the reasons I switched was concern that applications might start out not compromising my privacy and then update to track me and I wouldn't be able to block it since I wouldn't know unless I checked the permissions after every update.
genericanamoly
Why in the ever living fuck would I download an app from the white house? Shit I would assume they would do this and its not a shocker.
Jewdakris
I won't even go to their website
whiskeywonka
As a ex dev/it manager/wisp/bofh/etc I 1000% agree
decarnatedame
I just text them my whereabouts every so often. Saves bloating my phone with unneeded apps.
redditmcredditface
I dunno, but somebody in "authority" probably said "Hey, everybody download this app" so it probably exposed A LOT of staff's locations
huffnpuff72
Thats probably the main reason to do it. Track govt employees. As a bonus they'll get everyone else.
AnythingMuchShorter
I would sooner trust an app that came as an APK file disguised as an MP3 tried to pirate from a P2P service.
ilovebigmutts
Pre-installed on every phone after trumps AI gets elected to a 3rd term.
Froggie243
Good God. Thanks for the 1 sentence horror
arcontos
comes pre-installed on the trump phone surely coming finally in the next 2 weeks
SerialChickenLover
The question I have is why would tracking MAGA mean so much to them? Because I don’t think they’re naive to the fact that anti-MAGA isn’t downloading that.
thedarklord187
To prevent dissidents it's always about control with this they have unparalleled access and eyes on every single one of their members allows for further blackmail straight out of the Israeli intelligence honey pot playbook made famous by Epstein and maxwell
tychog99
A lot of maga people still stalk their estranged sane family members online
RetrogradeLlama
Holy shite. I just read through the code analysis. I'd guarantee that foreign resources have already been through this and spotted the same holes. Every dickwad in the White House who installs this is an immediate security risk. I don't care that they'll be compromising MAGAtt accounts.
lildude52ca
am i the only one that doesnt understand what any of that means or does?
jamiedBreaker
Are you experienced in this area? I'd like to scrutinize the article (as I do most of them), but computer science is so far away from my wheelhouses that I know literally nothing. I could not follow the article. TIA for any info.
SalamanderBSC
I'm not familiar with Android specifically so I can't comment on those, but the bit about it loading random crap from a github page and injecting it into a webview? Instant fail, do-not-pass-go, do-not-collect-200-dollars type situation.
A bright neon red flag and it's one of the easiest things in the world to avoid: review the code, and host a copy of it on your own network.
Compromise that account and a malicious actor can inject arbitrary code to do whatever the hell they want.
jamiedBreaker
Thank you, this is helpful!
Yellowchopsticks
Every dickwad in the White House is already a security risk.
PhloydPhan
Why would anyone download an app from *any* White House? Obviously the Trump one is poorly built and not secure and tracks you, but I wouldn't have installed an app built by the Biden or Obama administrations, either. What would it tell me that wasn't on the news, anyway? Push notifications when Joe went for an ice cream?
CALAMOSCOPYJANE
Idk, to pwn the libs, I guess?
shyriath
I was curious to see if maybe there was something else it was claiming to do, but no... assuming I was looking at the right app, news/livestreams is literally all it's for. Though I suppose that if they keep trying to cripple non-subservient media access to the White House, they might feel they've got control of a scarce resource.
johnxbear
You gotta remember. Some people's entire lives revolve around political stuff. Their entire identity is who they vote for.
johnblood616
Only one political party does that. At least here in Merica.
johnxbear
Let's not do that. Let's not live in the pretend world where only the other side is guilty. That's why we are where we are. There are plenty of democrats and republicans both who behave like that.
johnblood616
johnxbear
You honest to God don't think think there's a single democrat like that? Because you are being that person right now.
wejustdontknow
They didn't have an identity to begin with but now they have MAGA and they feel like they are part of something. It's all they have and they can't separate themselves from their parasocial relationship with the biggest fraud in the history of the US.
Clockworkdancerobot
Soon to be a requirement for any government service.
Neednoggle
Which, in different circumstances is something that really could be done well. This one is obviously a shit show, but the premise of easy access to government services is a good one.
mikeatike
And app for something that could be a website is never done well.
*looks around*
Especially the imgur app haha.
Clockworkdancerobot
Other countries manage this stuff... but we have capitalists wanting to privatize everything.
Pilgrymm
Here's the basic recap for tl;dr. I did read all of it though and it is both lazy and stupid what the white house did.
gronzilla
Real MVP
4Astaroth
I just went to the Playstore to report it for suspicious behavior. I didn't download it of course, cause nothing would make me download crap like that.
MacTually
I get the hate of the admin. But uh every startup does this shit too.
MacTually
You ever notice how apps have version numbers?
That's because there is always shit broken.
zuken
Not every startup is sending armed makes agents to abduct people for having brown skin or raiding state offices to steal private voter information though.
PullShporttel
Jesus Christ, it's piss easy to get the pem for DOD CA 6, why default anchors?
pilomotor
Everyone who understands what those words mean either quit in disgust or got purged for not being blindly loyal enough.
Epicentr
Sounds like that GitHub accounts needs to be compromised
powerrangerpl
On brand.
Pilgrymm
Corrodias
What's "stupid" about it? Remember that their goal isn't to provide something secure and useful to the public; it's to surveil and possibly to act as a backdoor.
xlr82xs
The stupid part is the javascript
Corrodias
I don't understand. Javascript is a perfectly capable language for transmitting your data to Trump.
xlr82xs
The javascript being injected to hide gpdr statements so americans don't find out governments in better countries don't just let companies do whatever they want.
relsky
Is it what I'd expect from an official government app? Hell yes.
UristImiknorris
So, what's the over/under on lonelycpp getting compromised?
ArchMagos
I'd say its an all but grantee that it gets "compromised" whether it actually does or if it was the excuse for why something fucked up got updated to it is another question.
CoBr2
Is it like, permanently running? Or do you browse through it? I don't understand how it's doing point 1, but I suppose I don't really know what the app is for in the first place.
CommunCreator
So, how long until someone develops a bot that spoofs the app and floods their data collection pipeline with garbage?
Einstein9073
How about we inject a root kit via that one guys gitHub account
CommunCreator
/insert Good_Burger.gif/ “Yes! I recognize a lot of those words!”
Einstein9073
The most exploitable weakness I saw in that pile of fail was having content pulled directly from some random persons GitHub account. If someone managed to compromise that account and put some virus in there, you could instantly hack every person who has downloaded the Trump app.
ChuckTenor
https://media4.giphy.com/media/v1.Y2lkPWE1NzM3M2U1ZnV4bnJtYTNzcHkwaDhzazhncjU4MTJ0bGpwMXF4Zm84bnkyMjQxZCZlcD12MV9naWZzX3NlYXJjaCZjdD1n/Ae7SI3LoPYj8Q/200w.webp
foreverinchains
Is it what you'd expect from this administration?
Absolutely.
DonL9
I'd also expect an AI running in the background monitoring for signs I might visit websites or apps that don't align with Dear Leader's whims, and I would be declared an undesirable.
Pilgrymm
100% and I hate it
Cookie0fPower
Agreed
Hypothesist
no. i expect some more bs to come out of it really .
IHateTransphobes
like a crypto miner.
CallMeMcGyver
Lazy and stupid is everything thing this White House does.
StellarJay77
Could be malicious compliance by a dev who knew all this shit would be easily caught in the hopes that it would be yet another thing to point to when/if accountability starts to be had.
mikeatike
If you working on an app for this administration, you aren't a good guy
StellarJay77
That is completely false. Tons of people were working government jobs before this administration took over and they weren't all replaced. People need to make a living so they can survive. So just quiting because you don't agree with what the administration is doing isn't and option for a ton of people.
mikeatike
The people that wrote the app are contractors. Probably paid millions for a hack job thst cost 10k to make. This is how the administration embezzles.
lildude52ca
i read every single one of these i don't have a clue what a single one of them does or what they mean.
certainlynotaserialkiller
you dont have to understand it, just with some reductive reasoning it means it tracks everything you do, where you are at all times and steals all your data.
TinyBadger101
I don't fully understand them all, but basically it's super unsecure. It's also tracking you and tossing your location data into a random database every ~5 minutes. It's being shipped with developer items in it; you would expect those to be separated out and never included in a product being released to the public, which indicates some really bad coding practices and can be a vector for the app to be compromised. It's using default Android app security which is not good. 1/?
TinyBadger101
It's grabbing code to run from a random dude's online location (Github repo), and we have no way of trusting or checking that it hasn't been hacked or compromised. If it is, the app will just pull that code and run it, whatever it is, which means it's also a vector for sneaking malware onto your phone. It's all stuff like that- basically, just horribly bad security and not following any best practices, plus tracking you and sending your data off without getting your consent first. 2/2
Totallyscrewedinaustin
Thank you, knowledgeable person!
Ozyie
I'm with you mate. Maybe an "explain like I'm 5" would be more helpful to us less tech savvy....
KiwiGameDev
You would likely get less dangerous code on your phone if you spent the day just clicking on big tiddy anime girl ads for the whole day. None of what this app is doing is acceptable by even “solo dev who doesn’t know any better”, let alone a government funded agency that can use leaked information.
Ozyie
It's crazy what a police state, data collection whore the US has become. I thought palintir was enough but obviously not. I'm going out on a limb here and say it's the Republican way forward. Control is slipping so what better way than to double down and tighten the reigns and throw another boot on your necks.
GoSibi
Easy. It's built horribly, is a huge security threat, don't even think about using it.
Ozyie
Yep copy that 👍
twoamartist
My MAGA idiot fam’s can’t figure out why their phones and laptops crash all the time. I keep wiping their devices for them. They think I’m some kind of genius.
SeasonedCitizen
Tell them intelligence and your ability to fix computers is woke. My MAGA neighbor asked to borrow tools, I told him that sounds like socialism.
Cactus21
Time to start charging a fee for your time!
Toqom
He's wiping the devices without their knowledge
twoamartist
It’s actually cathartic.
Neurisko
Blackhole all the magat media sites so they can start deprogramming themselves.
SeasonedCitizen
MAGAs? Tell them to fuck off. All my family and former friends that support that asshole I cut all contact with, I don't miss them one bit.
twoamartist
Nah. I feel sorry for them.
mieper3
Glad to hear it! Normal people cutting magass out of their lives only push them deeper into the maga echo chamber and create more hardcore magass.
Keep up the good fight any way you can bro 👍
ThatGuyInTheMountains
Shut up bot.
mieper3
Lol, what on earth made you think a comment like that would be a bot comment
thedarklord187
You shouldn't , the people who still support him and his fascists are in fact fascists themselves they are just too stupid to realize it.
ArchaeoEejit
Sunk cost fallacy
twoamartist
Interesting. I have definitely invested more in this than they have. Are they using me? Probably. Are they cognizant of that? No, and I am not put out by their ignorance.
Jamesstin
You don't think theyre using you? Only reason to not cut off maga family is if you're not financially independent
FeedTheNachoMan
I would approach less from the angle of "I don't personally mind them using me" and more from "I should stop enabling and normalizing their ignorant and self-centered entitlement".
Like, see it the same way as how you should always shut down the guy catcalling women, even if the woman in question is okay with it.