Hacker News Reader

Comment by leoedin | Hacker News Reader

I don't think Beeper can promise end to end encryption for 3rd party services either. Fundamentally if you're interfacing with a service like iMessage or Whatsapp - even if they offer end to end encryption - the message has to be decrypted and then sent to the 3rd party app. Unless that gateway is running on your phone, the messages have to be decrypted in the cloud somewhere. At that point, you are placing all your trust in the 3rd party app's cloud services.

Obviously they can still make better decisions than these guys - don't write confidential data to your logs! Don't unencrypted HTTP APIs! But unless the gateways to the 3rd party services run locally, you will never have end to end security.

Edit: Beeper has published their bridges as open source, so you could self-host it. That would at least give you full control of the stack. https://github.com/beeper/self-host

View on HN

Pretty much useless to self-host your own beeper server since you cannot use their client with your own homeserver.

EDIT: forgot to add that there are several beeper specific MSC's that other clients don't render, thus if you want the full experience you either use their service or just stick with a normal matrix instance.

I don’t know what extra features Beeper has, but I’ve been hosting my own Signal/Telegram bridges for 2 years now.

And it’s been working fine with Element as client.

As far as I can tell, the Beeper official client is a fork of Element, and there aren’t any huge missing features (other than easily setting up bridges).

True, but at the same time, it’s a very small attack vector. I’d say the vast majority of users could really care less that an iMessage is decrypted for a brief period in-memory on some Mac VM in a data center.

You place your trust in 3rd party cloud servers for so many things. Email, as an example, is far more confidential / important, but most people never have it encrypted.

It’s still a fair criticism, but I still see Beeper + iMessage as more privacy-friendly than like FB Messenger (which has way more users).

> I’d say the vast majority of users could really care less that an iMessage is decrypted for a brief period in-memory on some Mac VM in a data center.

And yet, that's precisely where I would go if I were law enforcement or a secret service. Tell them they're being used by terrorists/drug kingpins/CSAM peddlers, slap a gag order on 'em, and scoop up everything. And unlike Apple, Whatsapp or Telegram whoever hosts such a service can't even refuse such an order on grounds of technical impossibility because the messages are in plaintext in memory.

Law enforcement doesn't need to do that. They can go direct to Apple because Apple's iCloud backup breaks iMessage end-to-end encryption for almost all people anyway (few enable the advanced protection program that fixes this blatant hole and both sides need it enabled to preserve the encryption). This isn't a conspiracy theory, it's documented behavior from Apple. People don't know or care.

Use Signal if you want end-to-end encryption and don't feel bad about using Beeper for people stuck on iMessage.

Reply on news.ycombinator.com