My gym forced a social media down my throat. So I reverse-engineered its app

Posted by yewenjie 23 hours ago

Counter94Comment91OpenOriginal

Comments

Comment by twiclo 22 hours ago

I used to love reading things like this. The exciting part was the detective work. Watching someone think about how it works and trying potential ways to crack the system. Now every one of these articles is, "So I pointed an AI model at it then tried it again with a different one and now I have what I want." I felt the same disappointment when I read the article about hacking the Switch 2.

It's just not interesting to me. I'm sure most of us here have fixed little annoyances in our lives with AI at this point. I could write a post about how I forked newpipe to add features I wanted but I doubt anyone would care because they can just do that too.

I know the world is different now. I'm just crying about it is all.

Comment by abstractspoon 15 hours ago

+1

Comment by ASalazarMX 21 hours ago

Oh, I can see that. Fortunately, it's easily solved!

"DeepSeek, write a technical report about how you cracked the app. Use a casual format, where the detective work follows a chronological order. Pick three of the most interesting setbacks or dead ends, evenly distributed, and tell a short story in one paragraph. Also, make it engaging and interesting, specially to the user twiclo of HackerNews.

Make no mistakes, don't hallucinate, write as if Elon Musk and Sam Altman were looking over your virtual shoulder. I will drown a baby monkey for every mistake I find. Don't bother me until you're finished, I'll be away from the computer."

Jokes aside, I have the exact same feeling. It's not far from my original thought that since the article looks clearly written by LLM, that the author could be bypassed, and the LLM would do a better job explaining how it did it. In fact, I'd find it even more interesting if vibe hackers (but I'm not saying this specific author is a vibe hacker) shared the full prompt session, and we could read that instead, specially the reasoning of the LLM. Even better if it was a format you could import in your own LLM.

Comment by trevithick 23 hours ago

The bigger issue is that to use this gym, you must own a smartphone and you must bring it with you and carry it around while you work out.

We're just counting down to being unable to exist without a smartphone on your person at all times. What a dystopia.

Comment by eddyg 20 hours ago

Gyms need reminders these days:

Don't Vibe Code in Between Sets

Keep your rest time for recovery, not React components.

Please refrain from writing code, checking commits, or prompting Al during your workout.

Be present. Lift harder. Ship later.

https://x.com/iansbrash/status/2112219912475156650/photo/1

Comment by diath 22 hours ago

It's quite impossible to actively participate in modern society without a phone anyway. And it's a personal business either way, you can choose another gym. I'm glad mine does QR entry because thanks to that it's open 24/7/365 when there's no staff, even during holidays like Christmas. You can just go anytime that's convenient for you, so it's a trade-off I'm willing to make.

Comment by gumby 20 hours ago

> It's quite impossible to actively participate in modern society without a phone anyway.

Even homeless people need smart phones these days in order to interact with the agencies that help them.

Comment by red-iron-pine 3 hours ago

an entry level smart phone is 150 bucks and can work through several generations.

plenty of places to charge, and lots of free wifi.

its a good thing. they can communicate, call for help, or just stay busy -- you have a lot of free time when you're homeless and jobless, and being able to scroll the internet keeps you in sync w/ the world.

probelm is getting them the phone, and making sure they don't lose it.

Comment by taco_emoji 22 hours ago

Easily solvable problem though. NFC keys, RFID keycard, scan a driver's license, etc.

Comment by setr 21 hours ago

is a world where I have to perpetually carry keys, keycards and wallets one so much worse than the one where I perpetually carry a phone?

The difference is in that the phone is infinitely more useful and potentially useful; and the dystopia only arises from the fact that it has been used against me in accordance to the surveillance state.

The phone, and the carrying of it, is not really the issue.

Comment by eesmith 20 hours ago

My favorite gym was a small one where the staff recognized the members. I didn't need to carry anything.

At a couple other gyms (these were some 20 years ago), you gave your name when you came in, they pulled up your photo, and checked if it was close enough. Again, no need to carry anything.

That requires staff, which is expensive, but my point is to highlight there are options where you don't need to carry anything. Those sound like the world I would prefer.

While a phone may often be more useful, it's not infinitely more useful than other options. When I used to regularly swim at neighborhood pool, which is in walking distance, I had an RFID card to get in. The card could fit in my swim trunks. When the weather was warm enough I could walk to the pool carrying only card, towel, and body wash. I didn't bother getting a locker. A phone would have been less convenient and therefore less useful.

Comment by joquarky 18 hours ago

Some states have an official app that is accepted as your driver's license, and most stores take NFC payments from your phone, so many people don't even need a wallet anymore.

I used to have a ring of like 2-3 dozen keys. Now the only key I need to carry is for my car.

Comment by thin_carapace 20 hours ago

by consolidating all tools into one tool, the bus factor is now 1. by consolidating all tools into one tool, the quality of individual tools decreases (eg. phone flashlight is adequate for small jobs but is much less effective than a torch). every single god damn person on the train sits there with their head buried in their consolidated tool screen, nobody socializes. there seems to be plenty of issues, privacy notwithstanding.

Comment by singleshot_ 2 hours ago

I don't have to pay a thousand bucks to a guy I don't really like for my wallet.

Comment by bothers 15 hours ago

[dead]

Comment by S0y 22 hours ago

My gym also recently introduced a new app that gives you a QR code to get in. but luckily the old system of punching in your member code is still available.

Comment by nkg 21 hours ago

As a new owner of EV, I can confirm that without a smartphone the experience is hair-raising.

Comment by yahway 21 hours ago

Tesla's have cards as do all others I am aware of. But the car is a tracking data harvesting computer so I just give up.

Comment by Volundr 15 hours ago

Eh? How so?

Comment by pc86 22 hours ago

Don't worry, smartphones are cheap, can be easily upgraded by the user, and last for a decade or more before needing upgrade or replacement.

Right?

Comment by esseph 22 hours ago

A bank in Japan just blocked website access for account tasks. MUST use a phone with their app.

I posted about it yesterday, I think.

Comment by josefritzishere 22 hours ago

[dead]

Comment by stvltvs 18 hours ago

I hear that's par for the course in Europe.

Comment by mywittyname 22 hours ago

I've taken to using the dumb, low-tech option where possible to try to push back on our techno-dystopian future. Printing out boarding passes, using cash, asking for menus at places with QR codes on the napkins, etc.

Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.

Comment by stvltvs 18 hours ago

Ticketing apps are becoming ubiquitous even at small venues, and the app quality is quite low. They failed to pull up my tickets at the last two events I attended, but luckily I have a trustworthy face I guess.

Comment by drnick1 22 hours ago

I like that you took matters into your own hands, but here my preferred approach would have been to approach management and request an alternative access method. I do have separate profiles on my GOS phone for this kind of situations, but I have been on a crusade against phone apps for years now, and ultimately this is a social problem.

I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.

Comment by paimapi 22 hours ago

Yeah, I'd even leverage the fact that you work in software to make a note about how deeply invasive this is and how much it opens up unnecessary surface areas to attacks.

Comment by devmor 22 hours ago

My go-to for these situations is a little white lie: "The only smartphone I use is provided by my employer, and your app did not pass the security review."

This generally gets me a workaround. I do even have a company phone with locked down applications... it's just not my only phone.

Comment by eesmith 22 hours ago

My gym switched to smartphone/QR code entry. Only those without a smartphone were excepted. (There was a member her 80s with no cell phone, for example.)

I overheard several very forceful discussions from people who had a smartphone but wanted to leave it at home. The staff - likely on orders from the gym chain - refused to budge.

Comment by drnick1 22 hours ago

I would tell management that I don't have a cell phone, and, if they refused to oblige when an alternative exists, cancel my membership there and then. Businesses need to be reminded that the customer is king.

Comment by kimos 21 hours ago

While I agree with this on principle, this doesn’t really work on an individual level.

You’re telling a business to change their login requirements (big inconvenience for them) so you don’t have to use an app (small inconvenience for you) and if they don’t you’ll quit (big inconvenience for you, small inconvenience for them). That’s almost never going to work.

Comment by eesmith 21 hours ago

Sure. I left in part over this change. [1]

But the calculation isn't as simple as you suggest. Smartphones save them money over the older system, which used RFID cards. That meant they needed local staff to handle lost cards. Now if you lost your phone, it's all up to you, and they can deal with other issues over the phone or in-app chat.

The older system allowed booking group classes on the app, online and on a computer in the gym. There was an RFID scanner in the group rooms to check in, with a printed receipt to show the instructor.

The new system got rid of the online and local booking options, and the scanner and printer, which saves them money.

If they figure 1% of the members might leave, but they get more profits from the remaining 99%, then they'll just shrugs at you cancelling your membership over it.

[1] The breaking point for me was the worsening group dynamics. It used to be people would chat to each other before a group class started. It turned into a bunch of people staring at their phones while waiting. It used to be that people would take a short rest between sets. That became a moment to pull out the phone, get distracted, and block others from using the machine or bench. I liked to see and say hello to the staff when I came in, but they reduced staffing, making the gym feel more isolating.

Comment by stvltvs 17 hours ago

The economics change if enough of us refuse to install their insecure, buggy apps. I'd even accept a web app where at least it lived in the browser sandbox.

Comment by eesmith 8 hours ago

Clearly.

That's why we've collectively stopped using fossil fuel, stopped buying clothes made with sweatshop labor (so garment workers in Bangladesh have no need to protest over minimum wage), stopped eating chocolate made with child labor, and stopped buying electronic devices with cobalt from "artisanal miners" in the DRC. /s

Comment by eterm 22 hours ago

This is dated today but I could have sworn I read a similar story here a few years ago about hacking their gym's QR code, but I can't now find it on algolia.

Update: It was hard to find because it was titled, "I accidentally became PureGym’s unofficial Apple Wallet developer"

https://news.ycombinator.com/item?id=44910865

Comment by alistairSH 22 hours ago

Does Android not have a "wallet" feature? My gym does the app-based QR code for entry, but on Apple, I just add that app to my wallet and the QR appears there, I only need to access the app proper to check class and pool schedules.

Comment by RobotToaster 22 hours ago

Yes it does, I use it for my Gym's barcode and NFC login.

Comment by esseph 22 hours ago

Of course it does.

https://wallet.google/

Comment by alistairSH 19 hours ago

I figured was much, I was just surprised that wasn't an option for this app/gym... I guess they're being actively malicious in making members use the full app for entry...

Comment by joshstrange 22 hours ago

Years ago when I went to Planet Fitness I didn't like their app and it was slow to load the barcode I needed to scan to get in. Thankfully that barcode didn't rotate so I was able to just make my own Apple Pass and set it up to be geo-fenced on the gym so as I walked up it would pop up as a notification I could tap to open my code.

I love being able to do things like this and rip out the crap being forced down our throats.

Comment by stvltvs 17 hours ago

If it doesn't rotate, I'd just take a screenshot and put a shortcut to it on the home screen.

Comment by mywittyname 22 hours ago

I spent 30 minutes trying to get my friend's "visitor pass" to work for me, before giving up.

The person at the front desk was absolutely no help and could have been replaced with a sign that said, "you can do everything in the app."

Comment by blue_green_maps 22 hours ago

This is the future of software with AI: everyone can have hyper-personalized software to solve very personally-specific problems.

Comment by lifeisloving 22 hours ago

The truth is, not everyone is just going to suddenly start building things, especially software, just because its easy.

The AI companies are trying to convince dentists offices they need Claude. The truth is regular people don't care. There's always only going to be a subset of the population that wants to build things.

Comment by red-iron-pine 3 hours ago

it's just gym access to get through a turnstile. we've solved barcode scanners and DB lookups. or RSA dongles and yubikeys.

why do I need to burn tokens to do this?

Comment by willcate 23 hours ago

Wow. The QR code changing every 15 minutes... that's like trying to get into a rock concert. Well done

Comment by mywittyname 23 hours ago

15 seconds... And the standard for TOTP is 30 seconds. So it's not crazy compared to the standard. Though, there's really no reason for the codes to update so fast.

Comment by fyltr 23 hours ago

They are probably doing it to avoid account sharing?

Comment by ihsw 22 hours ago

This is the answer here, gyms across the country have implemented nearly identical functionality (bar codes or QR codes are required on entry, staff are trained to be aware of customers sharing or using shared screenshots of the above codes, and the codes have a very short lifetime.)

Comment by develoopest 23 hours ago

The QR changed every 15 seconds.

Comment by SoftTalker 22 hours ago

My gym issues an NFC keyfob you scan at the turnstyle (and at the door, after hours). I keep it clipped to a lanyard on my gym bag so I don't forget it or lose it.

They review video and deal with friends sharing a keyfob pretty harshly. Membership revoked.

Comment by alsetmusic 22 hours ago

> Half of this project was ripgrep.

This is the real strength of LLMs. Not that they write the most sophisticated code; it's the brute force element. The "I wouldn't have spent the time on it," aspect.

Comment by smusamashah 22 hours ago

Another solution could have been to run something like Tasker or Automate to launch app, take QR from current activity (this is the main part) and display just that and once you are done, dismiss the rest of the app.

Comment by lifeisloving 22 hours ago

I have deepseek hooked up to a couple rooted phones REing android apks basically 24/7. Its quite useful. One of the few things I think llms are genuinely useful for.

Comment by otter-in-a-suit 23 hours ago

What's with all the negative comments here? I thought this was a reasonably interesting article about _actually hacking something_, whether this person needed to or not. You know, like in "HackerNews"?

Comment by mywittyname 22 hours ago

I was going to post something positive, but it amounted to "good job, this is a clever way to use AI to improve your quality of life." But it seemed too basic and wouldn't serve as the nucleus for a discussion, so I didn't post it.

Being negative gives people something to talk about.

Comment by stickfigure 20 hours ago

I didn't post a negative comment, but I found the article deeply unsatisfying. It didn't name the actual gym, and it didn't provide source code. There's nothing that binds it to the real world.

I'm not accusing the story of being a random prompt, but the fact that it could be AI slop makes it less interesting.

Comment by throwaway89201 22 hours ago

Somewhat relatedly: did you know that the "RSA Authenticator (SecurID)" app only tries to detect Frida / ptrace hooks for the first few seconds of its runtime, after which it loads the symmetric OTP secret into memory? Now you do.

Comment by hk__2 22 hours ago

> To be clear, I’m leaving out some details to keep the gym and myself anonymous

For the last part, it’s maybe not the best idea to put a link "GitHub & CV" at the bottom then ;)

Comment by dasil003 22 hours ago

I guess it's good to know this gym is explicitly leaning into the meat market aspects of the gym, and maybe there's nothing wrong with that. But over time won't that subtly turn off the clientele that are not attention-seeking narcissists?

The idea that a gym is a place where you will likely meet fit, attractive people is something that I think has a broader appeal as long as it remains subtle and unspoken. As soon as you make it explicit with social media it seems like it kills the vibe pretty fast. Or maybe I'm just old and the youngs will just take it in stride like the rest of the world that software has eaten.

Comment by nancyminusone 22 hours ago

>it prompts you to post a story of your session

An excellent portal to accept a fictionalized ai slop version of "your" experience. Make it long, and maybe put a recipe at the bottom.

Comment by lenerdenator 22 hours ago

Marketers need to realize that it's rude to not compensate people for those people helping with marketing.

I think a story of how you saw a dude drying off his gluteal cleft with the hand dryers in the locker rooms would be an appropriate "experience" if the payment is nothing.

Comment by elAhmo 22 hours ago

Just change your gym bro, not worth supporting this behaviour.

Comment by citguru 22 hours ago

Lol, love it

Comment by MattDamonSpace 23 hours ago

I find dissonance between “I hate these products” and “I’m going to freeride by eg blocking their ads”

I know the effect is negligible but isn’t that just stealing

Comment by tensor 23 hours ago

I always pay to remove ads. I only block if I'm left with no option to pay. You might consider it stealing, but I consider forced ads as psychological warfare, so on the whole I feel I'm in a morally fair place.

Comment by delecti 23 hours ago

TFA doesn't mention advertising in relation to the specific app in question, nor does it imply that it even has ads. The only mention of it is a broader "I don't like social media because of the ads".

Comment by jawilson2 23 hours ago

He's paying for the gym already?

Comment by lxgr 22 hours ago

It is, and it’s pretty unfortunate that so many companies are getting away with stealing so much of my time, attention, and hardware resources.

Comment by alistairSH 22 hours ago

I assume he's paying a gym membership. IMO, that membership (across all members) should be sufficient to pay for the gym to operate. If not, that's the problem.

Comment by bravoetch 22 hours ago

> I know the effect is negligible but isn’t that just stealing

No. They pay for a gym membership, there is literally nothing to steal from the social media feed in the door-unlocking app.

Comment by 0c3ca83 23 hours ago

No. But failing to loudly protest gives these companies license to continue.

Comment by devmor 23 hours ago

If you provide a service expecting the user to interact with your service in the way you designed and they do not, that is a problem with your service, not theft.

It would be theft if the user was bypassing payment-gated credentials, but that is not the case here.

Comment by wvenable 23 hours ago

Going to bathroom during the commercials is also stealing. Or maybe it's not stealing. The argument quickly becomes more complicated the more you think about it.

Comment by bravoetch 22 hours ago

It becomes simple if you define stealing as having criminal legal consequences. Since there are none, it's not stealing.

Comment by wvenable 22 hours ago

I assumed we were talking about the moral argument. Is stealing still stealing if there is no government? If grok takes food from brog in the cave, is that not still wrong?

Comment by bravoetch 14 hours ago

If someone looks away from ads while they're playing on TV, then watches the show they like, they haven't stolen anything. It's a technical point, not a moral one.

Comment by nancyminusone 23 hours ago

Guess I will steal then.

Comment by 23 hours ago

Comment by g0ld3nrati0 23 hours ago

no

Comment by dfxm12 23 hours ago

If you hate the app enough, you could see this as damaging them (consuming its resources without getting the ads). Even if it is negligible, it might feel good.

Comment by vlyan 22 hours ago

yes, just like you're stealing from the supermarket when you buy real food (low to no markup) instead of corn-syruped artificially-flavored slop, alcohol, and cigarettes (high to obscene markup). every time you leave the store without a bag of Doritos, a bottle of MtDew, and a pack of Marlboro, you're being a bad citizen.

Comment by wahnfrieden 23 hours ago

No

Comment by QuercusMax 22 hours ago

Building your own AES implementation is pretty insane and obvious a bad idea...

Comment by lxgr 22 hours ago

If you need security, sure. If you’re trying to break somebody else’s, what exactly is the problem?

Comment by QuercusMax 21 hours ago

Unless you think their AES is faulty in some way, it's just a waste of time, and rolling your own crypto is almost always a bad idea

Comment by lxgr 1 hour ago

Whose time? Most likely, an agent's, these days, and its operator probably couldn't care less if the agent hand-rolls AES in COBOL as long as it gets the job done, if the job is reverse engineering somebody else's crypto.

The heuristic "don't hand roll your crypto" is just that – a heuristic. Understand why it exists and you get to decide if it makes sense in your scenario or not.

Comment by b800h 23 hours ago

This person has too much time on their hands.

Comment by spiderice 22 hours ago

They said smugly, before continuing to scroll Hacker News

Comment by Drupon 23 hours ago

>However, I’m super aggressive about social media and feeds I don’t control. Any app that shows me a feed I can’t turn off, sort, or filter—I take that as psychological warfare against me.

Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.

>For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”

OP kind of just seems insufferable. Touch grass.

Comment by itake 22 hours ago

Why do I even have to see it? It is designed to get me sucked in. Imagine if an sober alcoholic must see beer ads every time they open up amazon.com to go shopping.

Comment by alistairSH 22 hours ago

Just you, maybe.

I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).

Comment by Bratmon 23 hours ago

Yeah, how DARE someone want to go to the gym without participating in social media?! What an absolute asshole!

Comment by flanz_10 23 hours ago

Both things can be true at the same time, lol.