- cross-posted to:
- tech@kbin.social
- cross-posted to:
- tech@kbin.social
All messages are end-to-end encrypted before being sent. Beeper (and Apple) cannot see your messages.
Encryption keys never leave your device.
Beeper Mini connects directly to Apple servers. There is no Mac server relay, like other apps.
No Apple ID is required. Beeper does not have access to your Apple account.
Your contact list never leaves your device.
You must log in or register to comment.
Beeper has the same flaws as the app that got pulled recently. Your messages are being decrypted on Beeper’s end and retransmitted.
The app<->Beeper messages are end-to-end-encrypted. The iMessage messages are end-to-end encrypted. However, the entire E2EE scheme is broken by having a third party in the middel that can read all of your messages.
The same is true of Beeper’s other bridges as well; all protocols Beeper supports, except for Matrix, are decrypted in the middle. Proxying the messages in another way simply isn’t feasible. If RCS gets implemented and E2EE on RCS gets standardised, we may see decent iMessage interoperability, and hopefully MIMI combined with MLS will offer transparent communication between all the other chat services, but for now, E2EE and cloud bridges just don’t go together.
There are good reasons to use this approach (i.e. when you’re running a business and just want multiple agents to use the same chat apps, or if you don’t care for E2EE and just want to message people easily), but it’s important that the security properties of these apps aren’t overstated.
Did you even read the announcement? Please read it and then come back to comment and we can have a discussion.
You’re right, I see they reverse engineered iMessage (sort of). I confused Beeper Mini for Beeper, the encryption of which is often misstated.
I’m not all too confident in using a chat app that relies on reverse engineering Apple’s protocol and lying about the device being used (especially since a large portion of it is still done with the help of a centralised Beeper server for APN callbacks). The riskiest part of this approach is that if Beeper does get blocked/banned by Apple, your phone number will still be registered as iMessage capable and you need to remember to unregister your phone number or you will not be able to receive any (SMS) text messages from iOS users.
I see , well I hope this can make Apple to open iMessage.
I don’t think they’ll open iMessage to be honest. They are working on implementing RCS, though, and they have indicated that they were going to ask the standards body governing RCS for an official E2EE system (rather than relying on Google’s current, proprietary implementation based on open protocols).
I expect their third party integrations to go through RCS unless they are ordered by a court to open the original protocol.
A lot of work, data scrapping and security issue just for a pin ?
Seriously ?
What the point, except to simulate the possession of an iPhone to someone who should be a stranger for you or at least physically far from you ?
I clearly don’t get it.
Scam interest after a sim swapping attacks ? The goal, need to know it !!
I take it you’re not from the US 😅 texting is still the default here, and since apple refuses to open up iMessage and has not yet implemented RCS, Cross-Platform communication is pretty shitty. People get excluded from group chats because even a single user on a different platform will set it back to MMS
Yeah I’ve been excluded from work group chats on two separate occasions because they used iMessage and considering another platform was just entirely off the table.
Although to be honest, I consider being excluded from work group chats to be one of the best features of my phone!
Lol me too but I just had some friends that refuse to answer messages if its not on iMessage. I really hate Apple for doing this and I hope they get forced to open the protocol.
But why the obsession with iMessage and apple product?!? We don’t care about the colour of the bubble!!!
Apparently American teenagers do and will straight up bully you if you have an Android.
If only it was just teenagers, physically grown ass men and women do this too. Have had some I thought were good friends cut me off from talking to them “because I didn’t have an iPhone”.
IMO people who are that petty aren’t worth having in your life.
That’s what I figured too.
Sounds like a pretty great litmus test of a person’s character
Placating them doesn’t look like a great solution to me.
You do realize iMessage is more than just colored bubbles, right?
iMessage group chats.
Network effect. Gradually over time my whole extended family wound up with iphones for one reason or another, and Android phones would consistently break our group threads. The last few holdouts (not ideologically, they just didn’t need new phones) wound up switching to Apple afterwards to make everything smoother for the rest of us.
I’m not American and I don’t see how having iMessage on Android is worth the $2 monthly.
In my whole life I never knew a single person that was reachable only on iMessage or that was so stubborn to ignore messages on any other platform
Yeah but that’s how it is here in America , I love my Android and will never change so I guess I am stubborn too.
Their “how it works” blog article is worth a read - they’re using a blackbox reverse engineering of the protocol and re-implementing it natively in the app, so there are no man-in-the-middle servers. Impressive software engineering for sure.
huh, interesting. so from a security perspective is there any other concern with this protocol? at least they’re not using a mac relay server like Nothing Chats was
If the diagrams in their explainer are correct, their servers are only involved to forward Apple’s push messages to your phone through Firebase. That means Beeper knows when you’re receiving messages and how often, but nothing more than that; the phone syncs up with Apple’s servers.
I can’t find the source code so I can’t say much about the encryption code this app uses, but assuming they implemented the encryption well, security should be solid. However, the blog post explaining their architecture does link to another blog post that seems to have kicked off this project that says the most commonly documented format is the outdated encryption system without forward secrecy. I can’t find whether Beeper implemented the newer
pair-ecencryption or not.There is the risk that Apple bans you for breaking the ToS by using this service, of course, and it’s possible Beeper’s servers get blocked, the company gets served by a cease and desist. If Beeper does go down, the app will stop working well, and you’ll need to unregister your phone number with Apple or your iOS friends won’t be able to text you until that registration auto-expires.
You can ask more questions on Reddit!
If you have any questions, I’m hosting an ask-me-anything on reddit.com/r/beeper - feel free to ask any questions you have for us there (after reading our blog posts first to see if it’s already been answered!)
The tech is called PyPush and was developed by a teenager and purchased by Beeper.
For sure very interesting! And its open source and you can run it in your computer if you have the knowledge.
Yup, the PyPush python-based proof-of-concept can run pretty much anywhere there’s python.
I’m aware regular Beeper can be self-hosted, but Beeper Mini can too? Is there any more information on this or is that the “if you have the knowledge” part?
The mini version doesn’t need hosting, it doesn’t have a proxy middle man. A 16yo kid reverse engineered the protocol and then got contracted by beeper to implement it as beeper mini. It’s a client directly connecting to apple like imessage native.
Will it break? I’d argue if the cost of breaking it in engineer time is worth doing to Apple, yes. All they’d have to do is roll their own crypto and reverse engineering that might be impossible. Probably easier ways to break it but then maybe it turns into a cat and mouse game.
Legally it’s hard to say if it’s OK too, the end user is likely fine, but the developer especially being contacted may not be since to reverse engineer it could be breaking terms of service or licensing clauses though I’m not really sure what kind of damages could be claimed. To reverse engineer they had to use the original on jailbroken iphones to go through the engineering discovery.
Anyway the point is, it’s not going through beeper or anywhere other than Apple. So there’s no component to host. It’s different to beeper.
The problem is that breaking it will also break a lot of Apple devices.
I don’t know about the app itself, but the blog article links to the PyPush python-based proof-of-concept, which you can run pretty much anywhere.
I’m aware regular Beeper can be self-hosted, but Beeper Mini can too?
The difference between old and new is that all the services on the old one rely on Matrix bridges and the new one will not. They claim iMessage, Signal and WhatsApp will all be working on-device. So those obviously won’t be self-hosted. The rest they have yet to decide exactly how they will implement them but Matrix is going to be part of it.
Brad Murray said the end goal is to have everyone messaging each other directly on Matrix.
The first thing it asks you for when you open the app is a Google login. That’s gonna be a no from me, dawg.
Google login + $2 monthly? Screw that.
