4 ms·

Apple maintains iMessage compatibility with devices that are long out of support, if Beeper Mini is sufficiently similar to the client in for example iOS 12 the

Apple maintains iMessage compatibility with devices that are long out of support, if Beeper Mini is sufficiently similar to the client in for example iOS 12 then it makes an Apple decision to break Beeper fairly expensive. Even if they do the work to publish iMessage updates for the old iOS versions it just buys a little time before the new version gets reverse engineered, and that at the cost of poor user experience for the people with those devices in a form they will directly blame on Apple. Given all that I suspect he's right.

hedgehog 3y ago
Looks like Apple figured out a way to identify Beeper clients: https://techcrunch.com/2023/12/08/apple-cuts-off-beeper-minis-access-after-launch-of-service-that-brought-imessage-to-android/ https://techcrunch.com/2023/12/08/apple-cuts-off-beeper-mini...
lxgr 3y ago
> Even if they do the work to publish iMessage updates for the old iOS versions it just buys a little time before the new version gets reverse engineered There's probably a cliff in complexity. Once Apple starts requesting signed attestations from the secure enclave on the devices that have one, it's game over. They probably don't just yet, since still too many people use iMessage on first-party clients that don't have one, e.g. Intel laptops without a T1 or T2.
- ttul 3y ago
  If Apple does start enforcing signed attestations, they will say that it's to reduce abuse. I have no doubt (being in the anti-abuse world) that spammers and phishing gangs will immediately begin using Beeper to spam iMessage users because this allows them to avoid buying an iOS device. With end-to-end encryption, Apple may also decide to roll out privacy-protecting client-side spam and phishing detection, which would IMHO be a really great thing.
  - solardev 3y ago
    Maybe Apple needs an even blue-r bubble to set apart the super attested users from the mere blue bubble peasants
    - andygeorge 3y ago
      they could call it "apple blue" and charge a few bucks a month for it. People love that stuff
      - reiichiroh 3y ago
        I’d pay for a blue Apple checkmark!
      - cozzyd 3y ago
        They can desaturate the iPhone / MacBook Air users to disambiguate from the MacBook pro / iPhone pro / max users. Also device age in years will add hints of green hue. That way people know they're talking to someone who can afford to spend thousands of dollars on hardware every year.
        andygeorge 3y ago
        wait is this where "green with envy" will come from?????
    - dylan604 3y ago
      I imagine the next color being purple since that's a sign of royalty. Hail to the king baby!
  - sounds 3y ago
    The phone number registration https://blog.beeper.com/i/139416474/sending-and-receiving-messages https://blog.beeper.com/i/139416474/sending-and-receiving-me... will make it possible to enforce legal action against malicious and spammy messages. Note that iPhones already receive SMS spam and fraud just like every other phone. However, you are correct that the blue bubble is no longer a guarantee that the bad actor is using an iPhone.
- nroets 3y ago
  Apple can break Beeper without relying on the secure enclave: If Apple devices just send their serial number (IMEI for their GSM products), their servers can refuse to talk to hardware they didn't manufacture.
  - 1231232131231 3y ago
    I believe you can bruteforce/generate IMEIs somewhat easily. https://github.com/bstein/py-imei-generator https://github.com/bstein/py-imei-generator
  - WheatMillington 3y ago
    How does this address iMessages sent from non-iPhone devices?
    - HenryBemis 3y ago
      If in the data sent across (via Apple servers) the IMEI and serial no of the device are also transmitted, then Apple can in that millisecond query on their various lists/inventories that this device is legit (activated device + IMEI + serial) and if all lights are green, proceed to deliver, otherwise drop it. (perhaps different sets of data can be used, but it must be something that Apple already has, and the user has already provided (i.e. the iMessage email or the iMessage phone number, from the iPhone's enabled Settings)
      - nl 3y ago
        As someone who once bought fake airpods on ebay, I can tell you that Apple can't do this. I spent a number of days with them where they were trying to work out if they were fake. The serial number was real but they were fairly sure the number had been taken from a real product and reused, but were unable to say for sure. I ended up just returning them (because of the ebay return window) but found it interesting that Apple couldn't easily check this, and was very aware of the issue.
      - rfoo 3y ago
        Do you mean that I now have a nice party trick - DoSing friends iPhone from sending iMessage? :)
- jonhohle 3y ago
  There’s also the registration process that could be locked down and/or hardened. There may or may not be additional metadata (including out of band) that could identify first-party clients. I would think that’s the biggest issue right now. If spammers can register “real” iMessage accounts at scale without Apple hardware, Messages becomes less pleasant, very quickly.

hedgehog 3y ago

Looks like Apple figured out a way to identify Beeper clients: https://techcrunch.com/2023/12/08/apple-cuts-off-beeper-minis-access-after-launch-of-service-that-brought-imessage-to-android/ https://techcrunch.com/2023/12/08/apple-cuts-off-beeper-mini...

lxgr 3y ago

> Even if they do the work to publish iMessage updates for the old iOS versions it just buys a little time before the new version gets reverse engineered There's probably a cliff in complexity. Once Apple starts requesting signed attestations from the secure enclave on the devices that have one, it's game over. They probably don't just yet, since still too many people use iMessage on first-party clients that don't have one, e.g. Intel laptops without a T1 or T2.

ttul 3y ago
If Apple does start enforcing signed attestations, they will say that it's to reduce abuse. I have no doubt (being in the anti-abuse world) that spammers and phishing gangs will immediately begin using Beeper to spam iMessage users because this allows them to avoid buying an iOS device. With end-to-end encryption, Apple may also decide to roll out privacy-protecting client-side spam and phishing detection, which would IMHO be a really great thing.
- solardev 3y ago
  Maybe Apple needs an even blue-r bubble to set apart the super attested users from the mere blue bubble peasants
  - andygeorge 3y ago
    they could call it "apple blue" and charge a few bucks a month for it. People love that stuff
    - reiichiroh 3y ago
      I’d pay for a blue Apple checkmark!
    - cozzyd 3y ago
      They can desaturate the iPhone / MacBook Air users to disambiguate from the MacBook pro / iPhone pro / max users. Also device age in years will add hints of green hue. That way people know they're talking to someone who can afford to spend thousands of dollars on hardware every year.
      - andygeorge 3y ago
        wait is this where "green with envy" will come from?????
  - dylan604 3y ago
    I imagine the next color being purple since that's a sign of royalty. Hail to the king baby!
- sounds 3y ago
  The phone number registration https://blog.beeper.com/i/139416474/sending-and-receiving-messages https://blog.beeper.com/i/139416474/sending-and-receiving-me... will make it possible to enforce legal action against malicious and spammy messages. Note that iPhones already receive SMS spam and fraud just like every other phone. However, you are correct that the blue bubble is no longer a guarantee that the bad actor is using an iPhone.
nroets 3y ago
Apple can break Beeper without relying on the secure enclave: If Apple devices just send their serial number (IMEI for their GSM products), their servers can refuse to talk to hardware they didn't manufacture.
- 1231232131231 3y ago
  I believe you can bruteforce/generate IMEIs somewhat easily. https://github.com/bstein/py-imei-generator https://github.com/bstein/py-imei-generator
- WheatMillington 3y ago
  How does this address iMessages sent from non-iPhone devices?
  - HenryBemis 3y ago
    If in the data sent across (via Apple servers) the IMEI and serial no of the device are also transmitted, then Apple can in that millisecond query on their various lists/inventories that this device is legit (activated device + IMEI + serial) and if all lights are green, proceed to deliver, otherwise drop it. (perhaps different sets of data can be used, but it must be something that Apple already has, and the user has already provided (i.e. the iMessage email or the iMessage phone number, from the iPhone's enabled Settings)
    - nl 3y ago
      As someone who once bought fake airpods on ebay, I can tell you that Apple can't do this. I spent a number of days with them where they were trying to work out if they were fake. The serial number was real but they were fairly sure the number had been taken from a real product and reused, but were unable to say for sure. I ended up just returning them (because of the ebay return window) but found it interesting that Apple couldn't easily check this, and was very aware of the issue.
    - rfoo 3y ago
      Do you mean that I now have a nice party trick - DoSing friends iPhone from sending iMessage? :)
jonhohle 3y ago
There’s also the registration process that could be locked down and/or hardened. There may or may not be additional metadata (including out of band) that could identify first-party clients. I would think that’s the biggest issue right now. If spammers can register “real” iMessage accounts at scale without Apple hardware, Messages becomes less pleasant, very quickly.