8 ms·

> 2. Since Apple has no control over the Beeper mini client, they would not consider it safe, it could easily be spying on users without their knowledge. Since

> 2. Since Apple has no control over the Beeper mini client, they would not consider it safe, it could easily be spying on users without their knowledge. Since I have no control over iMessage, I would not consider it safe. It could easily be spying on me without my knowledge.

diligiant 3y ago
The basic assumption here is trusting Apple, provided that numerous security researchers have access to the platform. If you don't trust Apple, don't buy their products.
- 0cf8612b2e1e 3y ago
  It’s a two party marketplace. Even if I don’t like Apple, the alternative is not great either.
judge2020 3y ago
"they would not consider it safe" is from Apple's perspective, which is the only thing that matters when Apple is the steward of legally and technically enforcing who can use their APIs.
- CivBase 3y ago
  Sure. They have every right to do what they're doing. I'm just mocking Apple because I think their implication that they're the only trustworthy entity is ridiculous. We have no reason to trust them any more than we do Beeper or any other company. If Apple actually cared about security they'd implement an open protocol that is provably secure. Imagine if they supported something like Matrix. But that's clearly not their primary concern here. It's just a convenient excuse to maintain their walled garden.
addandsubtract 3y ago
Which is why most people (should) opt to use a cross platform messenger, such as Signal.
- SahAssar 3y ago
  If signal would officially allow third party clients, non-phone-number-bound users and maybe federation that'd be great. It does not.
  - anigbrowl 3y ago
    Signal does allow third party clients, Beeper is one. I agree about other things, and would expand on the list.
    - SahAssar 3y ago
      They do not officially and discourage it. Moxie and the rest of the company has been extremely clear that all third party clients are not considered supported or allowed, regardless if they can and do interact with signal services.
      - anigbrowl 3y ago
        Useful (though somewhat dispiriting) to know. I would feel a lot more forgiving toward Signal's UI shortcomings if I had a choice of alternative front-ends.
  - kccqzy 3y ago
    Does iMessage allow third party clients? No? Then why the double standard?
    - SahAssar 3y ago
      I'm saying that if we hold something to a higher standard lets actually hold them to a higher standard. Is signal better than iMessage? Probably. Should we ask for them to be better than they are? Yes.
    - thomastjeffery 3y ago
      It looks like we are comparing standards here, and that neither passes the bar.
Grustaf 3y ago
As pointed out below, "they" is Apple, but I would also assume that at least 99.9% (really) of users would trust Apple more than Beeper, i they had to choose.
- cqqxo4zV46cp 3y ago
  Let’s add a few more 9s to that, just to make it even more realistic.
willseth 3y ago
If you don’t trust Apple, then obviously you don’t use it. If you do, then it shouldn't be possible for a 3rd party client to break that trust. Users only see iMessage vs no-iMessage and have no other way to identify the client to decide for themselves whether to trust it.
- johnbellone 3y ago
  Not what he said. He said he doesn’t trust them (safe). The question you should be asking is why do you?
  - cqqxo4zV46cp 3y ago
    [flagged]
  - vGPU 3y ago
    Because they’ve proven to be the most trustworthy and if you can’t trust the manufacturer of the device and OS you also can’t trust any app running on said hardware.
- thomastjeffery 3y ago
  > If you do, then it shouldn't be possible for a 3rd party client to break that trust. A correctly implemented end-to-end encrypted protocol would be safe for all participating clients. The only way to break that security is by copying messages outside the protocol in the app itself. Neither of us knows whether iMessage or Beeper Mini does this. To bring up the possibility is to criticize both apps equally.
  - willseth 3y ago
    > A correctly implemented end-to-end encrypted protocol would be safe for all participating clients. As long as the clients are closed source, this is a circular argument. The client itself is a vector. Not just for a good E2E implementation but for the 3rd party company to not outright steal everyone’s messages, create a backdoor, etc. You have to be willing to trust every client used in the thread.
verandaguy 3y ago
> Since I have no control over iMessage, I would not consider it safe. Generally fair assumption. There's been some research (both positive and negative) around their E2EE claims, though AFAIK much of what's known about iMessage's E2EE guts has been learned through unofficial means. I think that for the vast majority of users, iMessage is probably safe enough. As a user, you have the agency to choose a messenger app that better suits your privacy/convenience balance, though in fairness, I think even among users who care about privacy, many don't know how to judge privacy features and implementation details well. Like others in this thread, I personally recommend Signal. It's widely available, easily usable, has been audited and researched a fair bit, and though it doesn't have a self-hosted option, it does have white papers out about its protocol which IMO are worth a read.
Grustaf 3y ago
> Since I have no control over iMessage, I would not consider it safe. I would trust iMessage about 95% less if I had written, or even implemented, the protocols myself, and I consider myself a pretty good developer.
- CivBase 3y ago
  If I'm expected to believe a messaging app is secure, the first thing I want is an open protocol. An open source client would be nice too, but honestly I'm fine with just the protocol. I do not need to have had a hand in developing any of this. It's not my expertise and, like you, I'd feel more comfortable having it developed by the experts.

diligiant 3y ago

The basic assumption here is trusting Apple, provided that numerous security researchers have access to the platform. If you don't trust Apple, don't buy their products.

0cf8612b2e1e 3y ago
It’s a two party marketplace. Even if I don’t like Apple, the alternative is not great either.

judge2020 3y ago

"they would not consider it safe" is from Apple's perspective, which is the only thing that matters when Apple is the steward of legally and technically enforcing who can use their APIs.

CivBase 3y ago
Sure. They have every right to do what they're doing. I'm just mocking Apple because I think their implication that they're the only trustworthy entity is ridiculous. We have no reason to trust them any more than we do Beeper or any other company. If Apple actually cared about security they'd implement an open protocol that is provably secure. Imagine if they supported something like Matrix. But that's clearly not their primary concern here. It's just a convenient excuse to maintain their walled garden.

addandsubtract 3y ago

Which is why most people (should) opt to use a cross platform messenger, such as Signal.

SahAssar 3y ago
If signal would officially allow third party clients, non-phone-number-bound users and maybe federation that'd be great. It does not.
- anigbrowl 3y ago
  Signal does allow third party clients, Beeper is one. I agree about other things, and would expand on the list.
  - SahAssar 3y ago
    They do not officially and discourage it. Moxie and the rest of the company has been extremely clear that all third party clients are not considered supported or allowed, regardless if they can and do interact with signal services.
    - anigbrowl 3y ago
      Useful (though somewhat dispiriting) to know. I would feel a lot more forgiving toward Signal's UI shortcomings if I had a choice of alternative front-ends.
- kccqzy 3y ago
  Does iMessage allow third party clients? No? Then why the double standard?
  - SahAssar 3y ago
    I'm saying that if we hold something to a higher standard lets actually hold them to a higher standard. Is signal better than iMessage? Probably. Should we ask for them to be better than they are? Yes.
  - thomastjeffery 3y ago
    It looks like we are comparing standards here, and that neither passes the bar.

Grustaf 3y ago

As pointed out below, "they" is Apple, but I would also assume that at least 99.9% (really) of users would trust Apple more than Beeper, i they had to choose.

cqqxo4zV46cp 3y ago
Let’s add a few more 9s to that, just to make it even more realistic.

willseth 3y ago

If you don’t trust Apple, then obviously you don’t use it. If you do, then it shouldn't be possible for a 3rd party client to break that trust. Users only see iMessage vs no-iMessage and have no other way to identify the client to decide for themselves whether to trust it.

johnbellone 3y ago
Not what he said. He said he doesn’t trust them (safe). The question you should be asking is why do you?
- cqqxo4zV46cp 3y ago
  [flagged]
- vGPU 3y ago
  Because they’ve proven to be the most trustworthy and if you can’t trust the manufacturer of the device and OS you also can’t trust any app running on said hardware.
thomastjeffery 3y ago
> If you do, then it shouldn't be possible for a 3rd party client to break that trust. A correctly implemented end-to-end encrypted protocol would be safe for all participating clients. The only way to break that security is by copying messages outside the protocol in the app itself. Neither of us knows whether iMessage or Beeper Mini does this. To bring up the possibility is to criticize both apps equally.
- willseth 3y ago
  > A correctly implemented end-to-end encrypted protocol would be safe for all participating clients. As long as the clients are closed source, this is a circular argument. The client itself is a vector. Not just for a good E2E implementation but for the 3rd party company to not outright steal everyone’s messages, create a backdoor, etc. You have to be willing to trust every client used in the thread.

verandaguy 3y ago

> Since I have no control over iMessage, I would not consider it safe. Generally fair assumption. There's been some research (both positive and negative) around their E2EE claims, though AFAIK much of what's known about iMessage's E2EE guts has been learned through unofficial means. I think that for the vast majority of users, iMessage is probably safe enough. As a user, you have the agency to choose a messenger app that better suits your privacy/convenience balance, though in fairness, I think even among users who care about privacy, many don't know how to judge privacy features and implementation details well. Like others in this thread, I personally recommend Signal. It's widely available, easily usable, has been audited and researched a fair bit, and though it doesn't have a self-hosted option, it does have white papers out about its protocol which IMO are worth a read.

Grustaf 3y ago

> Since I have no control over iMessage, I would not consider it safe. I would trust iMessage about 95% less if I had written, or even implemented, the protocols myself, and I consider myself a pretty good developer.

CivBase 3y ago
If I'm expected to believe a messaging app is secure, the first thing I want is an open protocol. An open source client would be nice too, but honestly I'm fine with just the protocol. I do not need to have had a hand in developing any of this. It's not my expertise and, like you, I'd feel more comfortable having it developed by the experts.