3 ms·
The Verge reports: > Since then, Beeper has rolled out some security upgrades that change the way the app handles security and prevent Beeper itself from seein
by k8svet 3y ago
The Verge reports:
> Since then, Beeper has rolled out some security upgrades that change the way the app handles security and prevent Beeper itself from seeing unencrypted messages from Signal, WhatsApp, and other encrypted apps.
Screenshots of Beeper’s desktop and mobile apps.
How?
- btseytlin 3y agoProbably on device encryption before anything is sent through their servers
- k8svet 3y agoI'm sorry, but that's not an answer. WhatsApp encrypts the message E2E, and then Beeper is bridging it into Matrix. The only way this would make any sense is if they've bridged E2E all the way through to ... the clients? Like, it doesn't make any sense.
- iLoveOncall 3y agoIt's a journalist's take, they probably mean that Bleeper doesn't phone home the messages from the client.
- k8svet 3y agoWell, now I regret that this comment sounds a bit dismissive, if another reply is true and they run the bridge locally. That's... impressive, and still surprising to think about. I'd honestly be fine with accepting the compromise of hosted bridges, especially since they seem to offer the ability to self-host the bridges, while using Beepers' Matrix infra. Gives them some extra cred in my book.
- talhah 3y agoThey actually reverse engineered Apple's iMessage and released a POC. At the time it worked and demonstrated on device bridges being a possibility. The runs locally and then encrypts it client side before it reaches beeper services. This can be enabled for Signal under experimental settings already. https://blog.beeper.com/2023/12/05/how-beeper-mini-works/ https://blog.beeper.com/2023/12/05/how-beeper-mini-works/
- Rebelgecko 3y agoThere's an "experimental" option in the app to run the server locally. I don't use signal so not sure if it works as well
- xinayder 3y agoThey break the terms of service of said services, they started this with iMessages last year and Apple shut them down after it was an obvious break of ToS, and they keep doing the same with other IM services.
- kevincox 3y agoBeeper has been talking about running on-device bridges rather than server-side bridges. So presumably that would allow encryption to the user's device, then re-encrypted on-device to Matrix then sent to Beeper.
- k8svet 3y agoWow, that's ... surprising.
- erohead 3y agoHere's how it works: https://blog.beeper.com/2024/04/09/how-beeper-android-works/ https://blog.beeper.com/2024/04/09/how-beeper-android-works/
- k8svet 3y agoThis is exceptional effort and communication to build something cool. I'm very, very impressed.