The Beeper blog is from the team behind the Beeper universal chat app, covering Beeper Mini, iMessage on Android, and encryption.
HN commenters link it for the in-depth explanation of how Beeper Mini works and for its universal chat vision, amid debate over Apple's response.
I am all against monopolies, I loved pidgin (and just saw that actually it still exists!), but the beeper-mini case was quite weird.
> The user will create an account so IMO if I have an Apple account (I own an old Apple laptop) then WTF would Apple care I send the bytes from a differrent application.
Actually, the initial version of beeper mini did not require an apple ID. And actually this was one feature they seemed to advertised a lot. Only the phone number was used: "No Apple ID is required" [1].
I guess the idea was that they could provide an upgrade to the current, unencrypted communication between iMessage and android (that does not require an apple id either). But I guess the issue here, was that people who used it did not necessarily have an apple ID, and thus not consented to apple's ToS, which as I understand makes it different than pidgin etc. And they actually say that this is a problem they are trying to fix:
"Phone number registration is not working yet. All users must now sign in with an AppleID. Messages will be sent and received via your email address rather than phone number. We’re currently working on a fix for this." [2]
Unless I misunderstand something, beeper mini stopped working because apple somehow disabled this "feature".
I mean I do not have any invested interest in this, I do not own an iphone and even if I did all people I know use other chatting apps, I do not own apple stocks or anything, I am all for piracy and whatnot, but I would not…
I'm surprised Apple hasn't cut them off yet. They must not be able to for some legacy reason. I suspect the only way to cut them off would be to cut off all the older phones like iPhone 3GS as well.
>the iMessage protocol and encryption have been reverse engineered by jjtech, a security researcher. Leveraging this research, Beeper Mini implements the iMessage protocol locally within the app. All messages are sent and received by Beeper Mini Android app directly to Apple’s servers. The encryption keys needed to encrypt these messages never leave your phone. Neither Beeper, Apple, nor anyone except the intended recipients can read your messages or attachments. Beeper does not have access to your Apple credentials.
>We built Beeper Mini by analyzing the traffic sent between the native iMessage app and Apple’s servers, and rebuilding our own app that sends the same requests and understands the same responses.
https://blog.beeper.com/p/how-beeper-mini-works
Looking at the Beeper Mini announcement [1], they clearly state that a user doesn't need an Apple ID to register their phone number and send/receive iMessages. Also, they describe direct, device-to-Apple interactions.
However, this article says:
> IDS is used as a keyserver for iMessage...
> The first step in registering for IDS is getting an authentication token. This requires giving the API your Apple ID Username and Password.
> After registering with IDS, you will receive an “identity keypair”. This keypair can then be used to perform public key lookups.
So how does the Beeper Mini app take an arbitrary Android phone number, register public keys for it with IDS, and perform public key lookup of recipients... all without ever using an Apple ID?
[1] https://blog.beeper.com/i/139416474/security-and-privacy
> Beeper Mini uses another workaround for the device UUID/serial/etc. requirement.
Have you got a source on that? As far as I know, there's no workaround possible because the authentication blob is based on the UDID/serial. Put differently: without UDID/serial, there's no way of authenticating with the message servers.
Beeper keeps referring to pypush when it comes to details in their write-up[0], and pypush, in turn, clearly states[1] the need for information like serial and UDID when dealing with the albert server and IDS registration request.
As a “workaround,” they simply stuff fake serials, etc., and cross their fingers that it gets through Apple’s scoring mechanism.
0: https://blog.beeper.com/p/how-beeper-mini-works
1: https://jjtech.dev/reverse-engineering/imessage-explained/
> With Beeper, you have to give your Apple ID to a third-party app, which they then proxy through a server of some kind (https://techcrunch.com/2023/12/11/beeper-mini-is-back-in-ope... "signing in with our Apple ID generated an Apple prompt that noted our ID was being used to sign in with a device “near Los Angeles, CA” (where we are not located.)")
I think they have another primary product of the same name that operates this way, but Beeper Mini never sends your credentials off anywhere other than Apple’s servers [0][1].
[0]: https://blog.beeper.com/p/how-beeper-mini-works
[1]: https://github.com/JJTech0130/pypush
From https://news.ycombinator.com/item?id=38531759
> Our long term vision is to build a universal chat app (https://blog.beeper.com/p/were-building-the-best-chat-app-on). Over the next few months, we will be adding support for SMS/RCS, WhatsApp, Signal and 12 other chat networks into Beeper Mini. At that point, we’ll drop the `Mini` postfix. We’re also rebuilding our Beeper Desktop and iOS apps to support our new ‘client-side bridge’ architecture that preserves full end-to-end encryption. We’re also renaming our first gen apps to ‘Beeper Cloud’ to more clearly differentiate them from Beeper Mini.