Beeper reverse-engineered iMessage to bring blue bubble texts to Android users::The push to bring iMessage to Android users today adds a new contender. A startup called Beeper, which had been working on a multi-platform messaging
Are their messages from their app going to show blue to iMessage users or something? Cuz I don’t see why you’d need to reverse engineer that otherwise. Even then… How hard is it to spoof a Mac address or other hardware identifier that says the message came from an iPhone?
The fact this is even an issue is just ridiculous to begin with. If you give that much of a shit: Use a different god damn messenger that treats everyone the same.
Why is this even a need to be solved? are people that stupidly superficial about the color of y fucking message bubble? (im not american but where im from literally nobody wiorth their salt gives a hoot)
The color of the bubble is only important because it helps iPhone users know who not to add to group chats, since the presence of a non-imessage user in an iMessage group chat downgrades the entire chat to grainy photos, no reactions/ read receipts, voice memos, typing indicators, etc. I don’t blame them at all, many of them don’t use any third party messaging apps because iMessage is built in and gives them everything that other chat apps have, with the benefit that they don’t have to convince anybody to install it because all their iPhone owning friends have it preinstalled.
Assuming that it’s actually reverse engineered, this is great news. If not, there’s a massive lawsuit brewing.
Seems like Beeper will see the cleartext of the replies, though, since they send the notifications via BPNs, right?
[edit: thanks for the replies. I see now the footnote on their BPNs diagram: “Push notification does not contain message contents” so it seems like the answer is “no they will not”]
No, with this new app messages are encrypted between you and Apple’s iMessage servers using iMessage encryption more or less the same way an iPhone does.
The push service simply notifies your device it has a message waiting, no message content passes through Beeper servers.
I really want to sign up for Beeper, but the fact I have to give them my phone number to sign up for a waitlist seemed like a red flag. How is their security profile?
This post is referring to beeper mini. It’s confusing naming, but that’s not the same as beeper(cloud service). Beeper mini is available to everyone on the play store and is not a cloud service. You just get it, login to Google (to pay the subscription cost) and it works. No invite needed
By that logic, there’s nothing guaranteeing iMessage on iPhones is secure or private either because it’s closed source. If you don’t want to trust Beeper mini, you’ll be free to run their iMessage bridge on your own Matrix stack when they open source it at some point, which they’re promising to do (and you still won’t know that Apple isn’t scraping your messages on the iOS side). When I decide to trust a company, it’s because I look at what they’re transparently communicating to their end users. Every indication is that they are trying to get out of the middle of handling encrypted messages. Their first move to make this happen was allowing people to self host their own Beeper bridges (which you can still do with Beeper Cloud if you prefer and you will know that your messages are always encrypted within the Beeper infrastructure). They aren’t going to release the source for their client ever because that’s the only way they make any money.
Notice how in the article they say “we’re not the middle man… Any more”? That’s because, up until now, Beeper has been working on a system where they operate as a middle man for your data.
To be fair they never claimed otherwise and all of the code for the bridges are open-sourced and can be run on your own servers so that those servers you control (as opposed to Beeper-owned servers) act as a “middle man” and none of your messages need be trusted to a 3rd party.
To put it simply: only the actual bridge on Beeper Cloud has access to unencrypted messages and you do have the option to run the bridge yourself while continuing to use the Beeper app. You can use as many or as few self-hosted bridges as you’d like.
A few bridges are preconfigured for self-hosting with just a couple of clicks for free through fly.io here
They do have to run servers in order to keep the service alive. If you want to run this stuff yourself on your own server that’s possible using PyPush. The reason they have to run those servers for you is to keep the notification service alive.
That’s to prevent multiple entries by one person. Their security is very good, with audits and their products being largely open source (for this, PyPush. For Beeper Cloud, their Synapse fork and their bridges.). Only the parts that don’t matter to security (the clients, mostly) are closed source.
Btw will they continue to live as Element changed licences to Synapse and Dendrite projects ?
