The White House recently unveiled a new app to give the public “unfiltered” access to “key priorities,” “historic moments” and “policy breakthroughs.” Now, it’s directing agencies to help install it on the government phones of federal employees.
The Trump administration launched the app, which promises to “[keep] you connected to President Donald J. Trump and his administration like never before,” in March.
The push to install the app on the devices of millions of government employees drew surprise from current and former federal officials, who called the move highly unusual and even dangerous.
40 Comments
NekoKoneko@lemmy.world · 83 pts · 90d
Here's the summary of the app from a few months ago: https://thereallo.dev/blog/decompiling-the-white-house-app
foodandart@lemmy.zip · 38 pts · 90d
NGL, if I was working for the government, that phone would NEVER get used and I'd leave it in a drawer at my desk. Turned off.
yakko@feddit.uk · 10 pts · 90d
I doubt they'd keep you long. Government jobs have been no fun for quite a while.
tonytins@pawb.social · 15 pts · 90d
That app has more holes than Swiss cheese.
emmanuel_car@k.fe.derate.me · 10 pts · 90d
At least that’s been removed. If only that were the only issue…
desmosthenes@lemmy.world · 3 pts · 90d
makes sense now
noodles@slrpnk.net · 64 pts · 90d
I guarantee it'll be badly coded and introduce vulnerabilities, which for government phones could be national security threats
halcyoncmdr@piefed.social · 38 pts · 90d
100% chance it will also spy on the phones and send that data to an insecure MAGA server piped straight through to ICE for filtering out anyone not loyal to the Reich, I mean Trump.
passenger@sopuli.xyz · 4 pts · 90d
https://www.atomic.computer/blog/white-house-app-security-analysis/
SuperNovaStar@lemmy.blahaj.zone · 12 pts · 90d
Honestly, good. I am pretty anti- national security at the moment.
chemical_cutthroat@lemmy.world · 11 pts · 90d
Good news! So are the Russians and Chinese and Israelis and...
tonytins@pawb.social · 3 pts · 90d
At what point do these all cancel each other out?
chemical_cutthroat@lemmy.world · 6 pts · 90d
The same time we all die in a nuclear winter.
grue@lemmy.world · 4 pts · 90d
I'm pretty sure we've known that for a fact since April.
BonsaiBoo@lemmy.world · 35 pts · 90d
There's no way this wasn't vibe coded with unsecured code from sketchy githubs and tons of foreign intelligence backdoors built in.
RunningInRVA@lemmy.world · 5 pts · 90d
Yes
ceenote@lemmy.world · 27 pts · 90d
If there are any people in my (government) workplace who still support Trump, they keep it to themselves. Everyone I know hates the entire admin. This app will probably only make it worse.
stumu415@lemmy.zip · 25 pts · 90d
But Chinese phones and EV's are dangerous to national security.
TrickDacy@lemmy.world · 10 pts · 90d
Two things definitely cannot be bad at the same time
ayyy@sh.itjust.works · 4 pts · 89d
They’re pointing out that the administration is lying and never cared about security.
Remember_the_tooth@lemmy.world · 13 pts · 90d
They were never going to just pack up and leave. If the Plan A direct coup doesn't work, they'll still have the Plan B of infested IT infrastructure.
quick_snail@feddit.nl · 11 pts · 89d
That's cool they get issued work phones.
I'd keep that in a Faraday bag whenever possible. And never bring it home. Keep it at the office
foggy@lemmy.world · 7 pts · 90d
Lmao.
Org-managed iOS/Android is not “install whatever some agency stapled to a PDF.” The app gets denied by identity, not a fucking sysadmin clicking through a GUI on orders from above.
iOS bundle ID + Apple Team ID + signing identity; Android package name + signing cert digest + Managed Play state. If it shows up anyway, the device will be dropped out of compliance and Conditional Access cuts it off from mail, Teams, VPN, SSO, managed browser, org data. I essentially turn the phone into a kids toy until I get my eyes on the situation.
This ain't a checkbox in the MDM console. The console is downstream. The source of truth is a repo. A service principal polls the live MDM tenant over API, diffs app approvals, assignments, compliance rules, and app-protection policies against the signed config, then PATCHes the deny back if some genius removes it. The audit log fires, SIEM ingests it, the pipeline reverts it, and the diff names the admin. You are not sneaking spyware into my mobile fleet. 😊
This is literally what I would tell an attacker to their face. I would not publicly even hint at the lengths I go or would go to keep our infrastructure frustratingly safe from shit exactly like this
quick_snail@feddit.nl · 1 pts · 89d
You've built a disaster
HootinNHollerin@lemmy.dbzer0.com · 6 pts · 90d
ruzzia playbook
CharlesDarwin@lemmy.world · 4 pts · 90d
Probably for similar reasons of having images of Big Brother's, oops, I mean, Donvict's, ugly mug staring at people from the DOJ building...
Maintain the cult-like air of omniscience around old doddering dozing donnie...the guy barely knows where the fuck he is or what he's even babbling about, but his handlers need to give everyone the impression he's really on top of everything...
Big Brother is Watching You
wirebeads@lemmy.ca · 3 pts · 90d
1984 is dead. Long live 1984
OldGrayDog@fedinsfw.app · 3 pts · 90d
Probably full govt spyware.
FuglyDuck@lemmy.world · 4 pts · 90d
it's their government phones. if it's not already full of spyware, I'd be disappointed.
Dashi@lemmy.world · 1 pts · 90d
If it's not your phone\computer (ex work\government devices) and if you are super paranoid even if it is your phone\computer, always assume someone is always watching and can see\recreate what you are doing.
Corporal_Punishment@feddit.uk · 1 pts · 90d
This doesn't change anything, not practically.
ALWAYS assume everything you do on a device provided by your employer is being monitored
Serinus@lemmy.world · 5 pts · 90d
It absolutely does, in a number of ways. First, this thing could be straight up spying malware or could be updated to be such in the future.
LadyMeow@lemmy.blahaj.zone · 4 pts · 90d
It’s a ‘company phone’ you don’t control it; so you can’t trust anything on it.
Always use work provided devices only for work related stuff. There is every reason to believe the can and do monitor everything that happens on them.
This is true of government devices and private company devices.
Serinus@lemmy.world · 3 pts · 90d
It's the "work related" stuff that I'm concerned about leaking.
LadyMeow@lemmy.blahaj.zone · 2 pts · 90d
Oh, that? Yeah, well …. Yeah. The entire administration is incompetent narcissists addicted to substances, with the most corrupt President ever at the head, so yeah. Audi don’t forget the pillaging that doge did. Idk, it’s a total mess, and all sorts of secrets and personal information is floating around now. :(
Corporal_Punishment@feddit.uk · 1 pts · 90d
From a personal perspective, it changes nothing if you already use a work device with the knowledge your use is being monitored.
From a general data security point of view its terrible for the reasons you describe, but that's a government problem not a personal one
stoy@lemmy.zip · 3 pts · 90d
It injects content into websites, I's say that changes a LOT actually.
Corporal_Punishment@feddit.uk · 1 pts · 90d
And what's stopping Trump just convincing MAGATS to install it willingly?
If they want to inject data into websites (whatever that means) then there easier ways when you have an army of morons hanging off your every word
tonytins@pawb.social · 1 pts · 90d
You're not exactly inspiring hope.
Corporal_Punishment@feddit.uk · 3 pts · 90d
Why would you expect privacy on a work system?