a government app shouldnt have crazy analytics and tracking and whatever. but i dont think loading google fonts or embedding youtube videos is really all that wild in the grand scheme of things.
given the title, i was half expecting some sort of egregious list with, like, palantir and some ICE domains or something. i dont like the app, but google? facebook? that is pretty boring.
the title probably should focus on nature/severity of the requests. titling it with a % of all requests feels bait-y if google/facebook/twitter isnt off in its own category. they have all sorts of dumb little requests to all sorts of domains that really inflate the numbers.
(as a note, atomic.computer also loads analytics and google fonts. which is whatever. but if they are going to imply 3rd-party requests are inherently bad just by nature of being 3rd-party, they may want to clean their own house a little bit.)
edit: original title at the time of my comment was "We intercepted the White House app's traffic. 77% of requests go to 3rd parties"
Though if your comment is solely based off of the previous title alone, then fair enough.
Are ICE and Palantir forbidden from buying data from Google or Facebook?
This sounds like a smart way to own an app where you decide what you want to track and nobody is stopping you from getting the data you are phoning home. And you can launder it through normal tracking providers.
Current government tries to steer the ship that is the US in the direction of an autocratic state as can be seen by most of their actions. But it's a huge ship and it takes time, no matter how hard you try (luckily).
i am not sure what you are intending to imply. what suits me and how?
i called it boring. flip on a news channel, click any other link on the front page here, or look outside and you will find something more interesting than "app sends a lot of requests to google".
that doesnt mean i think it is good or that i am making an excuse. it means that it is boring. this site is supposed to "optimize for curiosity" or however dang phrases it.
> All HTTPS traffic was decrypted and logged. No modifications were made to the traffic. The app was used as any normal user would use it.
Is it really that simple to inspect network traffic on an iPhone, namely to get it to trust the user-installed cert? I do quite a bit of network inspection on Android and I find it to be painful, even if the apps don't use certificate pinning.
Regardless, it highlights the importance of having control of our own devices, including the ability to easily inspect network traffic. We have the right to know where our data is being sent, and what data is being sent.
I recall during COVID it was discovered that Zoom was sending traffic to China. There was also the recent case of Facebook tracking private mobile browsing activity and sending it to their servers via the FB app. Imagine how much questionable traffic goes unnoticed due to the difficulty in configuring network inspection for apps.
iOS still trusts user-installed certs by default, unlike Android's opt-in model.
However, this only applies to apps using the OS TLS stack. Apps packaging their open openssl may use their own set of certificate authorities. Also, most big apps use certificate pinning for most of their domains.
Apps from Twitter or Facebook probably won't work due to pinning. Quick and dirty could-have-been-a-single-web-page apps, such as this one, usually won't bother with any of that, and neither do many tracking libraries.
Of course, malicious apps can detect when someone is using an altered certificate and choose not to send traffic until the MitM is over.
https://www.trickster.dev/post/setting-up-rooted-android-emu...
Apps that do use cert pinning is a whole other matter, I’ve tried unsuccessfully a few times to inspect things like banking apps. Needs a rooted device at the minimum.
Also looked into this a long time ago… could someone tell me how to do this with cert pinned apps ?
Meanwhile I've always found it amusing that there's a loud, probably corporate-owned/Big-Tech-brainwashed subset of the "security" crowd who complains about MITM proxies.
Yes it was. Imagine, all those (lower) governments holding crisis meetings and sending the video and audio to China. What are the chances that all that stuff was recorded. Nice training data for some deepfakes.
https://news.ycombinator.com/item?id=47555556 https://news.ycombinator.com/item?id=47577761
It's shocking how many third party connections an average website opens. It's particularly true for news websites. Interestingly, atomic.computer also attempts to load Cloudflareinsights and some Google fonts, both of which are denied on my network. This is precisely the kind of requests that make it trivially possible for Google to follow people around the Internet, and the vast majority of webmasters are complicit of this.
In Australia, apps handling government data must comply with the PSPF (Protective Security Policy Framework) and the ISM, which explicitly restrict data flows to untrusted third parties. A government app routing 77% of requests externally would fail an IRAP assessment on day one.
The fix is straightforward: self-host fonts, use first-party analytics, and treat every external request as a data exfiltration vector. Government digital teams know how to do this — the question is whether anyone is actually reviewing the network behavior post-deployment
Honestly—why? What is in this traffic that mandates heightened scrutiny? It strikes me as simply about brand.
Personally, I want the most stringent CORS settings to read about his gold Sharpie pens.
Not disagreeing. But why should its provenance force a higher standard? It’s a glorified news app, to my understanding. Is its breaching worse for national security than some weather app that had its moment in the sunlight?
I would be interested to see how this compares to industry standard though, 77% doesn't seem outrageous to me given all the trackers and advertising code I've seen over the years. It wouldn't surprise me if this is inline with many apps people install and don't think twice about.
edit: they seemed to have updated the store listing, so the "data collected" section is correct.
The relevant part of B2C is the 2C part, not the B. Mass market apps are generally ridden with telemetry and SDKs. Moreover I'm not sure how you think it's a "fair question" to go from a remark about how other apps are equally bad, to thinking I want the US government to operate as a business. It's like doing:
A: "I called the IRS and was put on hold for 2 hours, can you believe that?"
B: "To be fair that's the experience calling into most businesses, like banks or the cable company"
A: "Wow so you think we should be running the IRS like a bank?"
>I think most people would except an official government app to be held to a higher standard than the average B2C app.
Is this a "yes, in an ideal world that's how things should be" type of statement, or are you claiming "yes, government agencies have a track record of delivering technical excellence on software projects, and this particular project was especially bad"? The former is basically a meaningless platitude, and I don't think anyone seriously thinks the latter is true.
The flip side of "whataboutism" is "isolated demands for rigor"[1]. Going back to the IRS example, is it a fair retort to point out that IRS's hotline only sucks as much as any other large organization's hotline, or is it "whataboutism"?
[1] https://slatestarcodex.com/2014/08/14/beware-isolated-demand...
See my earlier comment about how this is a meaningless platitude.
>Businesses intentionally throttle customer service lines for profit reasons. The government should not.
None of this was presupposed in the original comment, only that wait times are long.
If a company proactively evades taxes for profit, do you give the government the same pass? Companies skate and fight all this through litigation and interpretation. The government's duty is to the people and to uphold the law, not fight it. They are held to a higher standard of law, accountability and practice in all undertakings. What exactly are you refuting here?
Specifically because it's not a natural market. There are people who secure a 2-year, consequence-free term to impact U.S. law, at the behest of people with money.
Lobbying is special interests dictating decisions that often are not financially, morally, or otherwise ideal/beneficial to the other party (the United States and its people). This wouldn't fly at any corporation or business because there would be direct impacts on the bottom line or reputation of the company.
Would you like to be able to ask your representative to focus on a particular issue?
That makes me net more surprised after reading your comment.
You're not surprised the white house is worse than any other app you've seen by 20%?
People should care.