My gym forced a social media down my throat. So I reverse-engineered its app

A fitness enthusiast recently joined a new gym and found their experience to be generally positive with the equipment and management. However, they were frustrated by the app's social feed which displayed users' gym selfies and forced them to post their own. This made the user feel like they were subjected to involuntary social media, which they strongly disliked.

The user, who had not used social media in over a decade, was adamant about blocking ads, YouTube comments, Shorts, and suggested videos. They even used browser extensions to prevent LinkedIn's news feed from appearing. Determined to bypass the app's unnecessary features, the user began reverse-engineering the QR code generation logic.

They quickly discovered that the code changed every 15 seconds and that screenshots were not allowed on the screen. After turning off Wi-Fi, the user found that the QR codes remained valid for several days. Using tools like Android's SDK, OpenSSL, and WebCrypto, the user managed to extract the necessary secrets to generate the QR codes locally.

This allowed them to bypass the social feed requirement and access the gym's facilities without the intrusive app interface.