Discussion
Why in the world would the White House's mobile app need permissions or any kind of interaction with (or even reference to) the Chinese tech giant Huawei, whose products are banned from the United States for concerns about national security, espionage and intellectual property theft? Here's a scan at Virustotal.com of what's bundled in the latest White House app:
@briankrebs "That thing I said yesterday on national television in front of over three hundred million people? It didn't happen, it's fake news."
A full an exhaustive #infosec analysis (including the updated version) of the #Whitehouse app is here:
https://www.atomic.computer/blog/white-house-app-security-analysis/
As a counterpoint, this security firm says "nothing to see here... because everything is shitty in mobile world"
https://www.nowsecure.com/blog/2026/03/31/an-experts-perspective-on-the-white-house-app-putting-security-findings-in-context/
I am going with the 1st source, as it still has major designed-in anti-privacy/malware features.
Because they know not what they do ...
@briankrebs How soon you forget - in the first 100 days, Trump turned Elon Musk, chainsaw and Nazi salutes and all, with his hackers backstopped by armed thugs, loose in every corner of the executive branch IT infrastructure, including the Treasury. Never attribute to incompetence that which can be explained by racketeering!
@briankrebs Really dumb, but I believe most IDE > publish pipelines drop this in as Huawei isn’t permitted to use the same push notification infrastructure as most other Android versions.
Not a defence, and it’s lazy development.
But playing devils advocate you could argue Firebase is probably as risky if not more so, given what is on the other side of it. Might as well be “GitHub[dot]com/*”, it always makes me nervous.
Still, the evergreen statement that SBoMs and people that care about them are a dying breed.
@briankrebs So they are inept and stupid... I'm shocked....
@briankrebs HMS content in that library is compile only per https://github.com/OneSignal/OneSignal-Android-SDK/issues/1563
@briankrebs god those guys are idiots
@briankrebs US govt making apps great again
These r not serious people
BTW, this latest version of the White House app actually has only one reference to Huawei. Previous versions had them all over the place, including under network permissions
@briankrebs also mentions Oppo another Chinese brand. Might not be at the same level of scrutiny as Huawei though.
@briankrebs say it isn't so.
@briankrebs They are so thick they probably thought it is Hawaii , ALOHA china plate yir new mate, Donald .
@briankrebs oh come on, the subcontractor writing the app pulled in a generic cross platform push library which also supports HMS.
You're going for cheap ragebait here, you could easily check which lib they used that pulls in that dependency.
@briankrebs Dose it come pre-installed on the Trump Mobile T1 Phone📱
@briankrebs - They know how to scan the republicans, certainly.
I realize this is small potatoes compared to other dumb/actively harmful stuff this administration is doing, but the POTUS just got done telling the world that China interfered with the election he lost, and here he's mandating that govt workers install an app that has components referencing Huawei??
@briankrebs I think we all picked the wrong day to stop sniffing glue
@briankrebs
The STUPIDITY is….what’s everyone’s favorite word again….oh yea, UNPRECEDENTED!! 🤡
@briankrebs How else is he gonna prove China was involved in him losing the midterms?
If you want to know what Drumpf is up to, listen to what he’s accusing others of doing. DARVO all the way down.
@briankrebs It doesn't matter if what he says makes sense, it only matters that you're listening.
Wait...what?!
Am I misunderstanding you?
His message was China is bad, here use a product from China that's known to spy on us.....?
What did I get wrong...😊
@briankrebs Huawei has a “Push Kit” for app developers which appears to use a Huawei service for delivery, which is eyebrow-raising…
@briankrebs Does the App also needs📱 GPS📡 🛰️ on & No VPN.📵 disabled?
@briankrebs Let me guess, some LLM code helper generated some/most/all of this app, and that's what it felt like doing. Quite a skill.
@briankrebs Considering that the Trump regime's actions have been more aligned with the strategy foreign policy interests of #China in general, and especially the #CCP in particular, than any other government principal's interests, I suppose it should not be too surprising if the #WhiteHouse app leaks information to #Huawei.
@briankrebs Just a guess: Maybe they distribute the same app also in the Huawei App store and want to use push messages with Huawei smartphones, too... which is of course inconsistent wuth the ban, but well. It's the White House 😉
@briankrebs A lot of that stuff is just thrown in by default by mobile development IDEs, and no-one removes them because they don't really understand what they're for and "don't want to break anything"
A minimalist social node dedicated to high-fidelity exchange and digital autonomy. CoreSignal strips away the noise of the modern web to provide a clean, functional space for meaningful connection within the Fediverse
