Hacker News Reader

Comment by jay-barronville | Hacker News Reader

I’m a former Android fanatic turned iPhone user. I still own Android devices, but my primary device is an iPhone. I haven’t had something excite me as much as this Beeper Mini situation in years—I love that they’re doing this.

One of the things that got me to switch to the iPhone a few years ago was the fact that it seemed Apple was actually doing a lot of the right things when it came to privacy and security. Obviously, I was still pretty skeptical of them, but compared to Google, Apple’s track record seemed a bit more trustworthy.

The way Apple tries to lock you in though while stifling competition is extremely disappointing. They’re on the wrong side of history.

View on HN

> it seemed Apple was actually doing the a lot of the right things when it came to privacy and security

Isn't this one of them?

A security hole existed that permitted Beeper to pretend to be your Apple device. In this case, it was being used for non-nefarious purposes, but that doesn't mean everyone would. Apple's fixing that hole seems in-line with your desired "privacy and security".

> A security hole existed that permitted Beeper to pretend to be your Apple device.

_An_ Apple device. Not _your_ Apple device.

"Hey, I'm /u/ceejayoz's new iPhone! Bwahahahahahaha. Ahem. I promise I'm really the iMessage client you're expecting. Start sending me a copy of all their potentially sensitive messages."

Again, how do we not classify that as a security issue?

If you’re referring to the history, then it cannot talk to the iCloud keychain, and even if it could, it would require your credentials. Same thing if you are just talking about incoming messages, they need your credentials. If they have those you’re already fucked. And also, they could just have taken an iPhone and log in there with your credentials.

It's understandable Apple doesn't want third-party apps proxying Apple ID credentials. Ever.

It isn’t proxying afaik, it is calling the Apple servers directly. The only thing getting to Beeper servers (and that can be disabled) is an IDS key without its matching decryption key, for Beeper to be able to see if messages are coming to signal the phone (which has the encryption key but is not connected continuously) to fetch it and show the notification.

At the very least, it's being proxied through the third-party Beeper app, which Apple has no reason to trust. (Nor the Android device it's running on.)

https://techcrunch.com/2023/12/11/beeper-mini-is-back-in-ope... appears to indicate more than that, though.

> In tests, signing in with our Apple ID generated an Apple prompt that noted our ID was being used to sign in with a device “near Los Angeles, CA” (where we are not located.)

Because the user explicitly authorized the app by logging in with their own credentials and has the keys.

So wait, if I send people messages from a different number and say I'm /u/ceejayoz's new number, they will believe me?

What is stopping me from buying a second-hand old iPhone and doing this without Beeper?

> What is stopping me from buying a second-hand old iPhone and doing this without Beeper?

In that scenario, you're still using the official client, which Apple presumably knows isn't silently siphoning messages off to somewhere else. You're on official hardware with an official client.

Sorry, I misunderstood the previous comment. I thought you were worried about other people pretending to be you to your friends to trick them.

Is what you are asking this?

1. I install Beeper.

2. I log in to Beeper with my Apple ID, for the explicit purpose of accessing my own iMessage data.

3. ...

4. Gah! How could Beeper access my iMessage data even though I installed and authorized it just so it could access my iMessage data?

5. "Gah! Beeper was hacked/compromised/deliberately siphoning off Apple ID credentials into a log/error reporting/bad actor's database and now millions of people have had their sensitive texts and other iCloud data exposed."

Facebook and LinkedIn used to try to get people to hand over their email credentials so they could "help you find your friends on Facebook"; people were correctly skeptical then. Giving my Apple ID to a third-party seems insane, given what can be done with it, and I'd imagine Apple sees it the same way.

> Giving my Apple ID to a third-party seems insane

That's fair. You'd be happy to learn that literally no one is forcing you to hand over your Apple ID to Beeper. Your approach is very good for your account safety, but you don't need to keep other people safe from themselves.

Do you have similar concerns when people use non-Google-approved email clients to use Gmail, or alternative YouTube clients, or Signal/Telegram forks?

Perhaps you think HN should ban alternative clients or weird web browsers too. Too bad a lot of people think interoperating clients are important or we would be left with the Web Integrity crap to "keep us safe".

> Do you have similar concerns when people use non-Google-approved email clients to use Gmail.

If they ask for credentials, absolutely. Google has both an OAuth flow and the ability to generate app-specific passwords (which correctly have very limited abilities) so I never have to pass over the real creds.

I have never given my Gmail credentials to Apple, but I get my mail just fine.

Google requires you to register an application and get it approved to log in with OAuth, you can't just use it with arbitrary callback URLs. Why should I need to ask Google permission to use my own data, or ask for Google's permission to allow other apps to use my data?

If the Beeper service is totally fine, and you mind their auth methodology, perhaps you should complain about Apple not providing better iMessage auth options.

Instead, you complain about users being able to give their own data to an app they chose to install.

> Google requires you to register an application and get it approved to log in with OAuth, you can't just use it with arbitrary callback URLs. Why should I need to ask Google permission to use my own data, or ask for Google's permission to allow other apps to use my data?

I specifically mentioned the other approach; if your email client doesn't implement the OAuth style approach, you can generate an app password. https://support.google.com/accounts/answer/185833?hl=en

> Isn't this one of them?

I don’t believe so. Beeper Mini uses Apple’s protocols the same way the native iMessage uses it; they didn’t exploit a security hole (unless you classify the device faking part as a security hole—I don’t). They maintain the E2EE flow.

The protocol's implementation is intended to verify you're connecting a device Apple built, with stuff like secure enclave and end-to-end encryption as known quantities. With Beeper, you have to give your Apple ID to a third-party app, which they then proxy through a server of some kind (https://techcrunch.com/2023/12/11/beeper-mini-is-back-in-ope...; "signing in with our Apple ID generated an Apple prompt that noted our ID was being used to sign in with a device “near Los Angeles, CA” (where we are not located.)")

I don't see how you could describe that as anything other than a security hole.

I know that HN is not one homogeneous opinion, but it always comes up in these Apple threads that all this device attestation and secure enclave stuff is unambiguously good because Apple does it, but when it comes to TPM key escrow or Web Environment Integrity suddenly everyone is up in arms about how it's a total violation of a user's freedoms to do what they want with their device.

You shouldn't defend something that's inherently consumer hostile just because it happens to be for something you like.

I'm OK with titrating skepticism on a proposal based on the motivations of the proposer.

To Godwin a bit, I'd treat "we should make the trains to Auschwitz run more on time" differently depending on if it's being proposed by the German government in 1942 or the Polish government in 2023.

It can be both a security issue and something that doesn't optimize user freedom.

> With Beeper, you have to give your Apple ID to a third-party app, which they then proxy through a server of some kind (https://techcrunch.com/2023/12/11/beeper-mini-is-back-in-ope... "signing in with our Apple ID generated an Apple prompt that noted our ID was being used to sign in with a device “near Los Angeles, CA” (where we are not located.)")

I think they have another primary product of the same name that operates this way, but Beeper Mini never sends your credentials off anywhere other than Apple’s servers [0][1].

[0]: https://blog.beeper.com/p/how-beeper-mini-works

[1]: https://github.com/JJTech0130/pypush

From your first link:

> To work around this limitation, we built Beeper Push Notification service (BPNs). BPNs connects to Apple’s servers on your behalf when Beeper Mini Android app isn’t running. We can do this while preserving user privacy thanks to Apple separating the credentials needed to connect to APNs to send and receive content (the “push” credentials) and the keys needed to encrypt and decrypt messages (the “identity” keys). Push credentials can be shared securely with the Beeper Push Notification service, and BPNs can connect to APNs on your behalf. Whenever BPNs receives an encrypted message that it won’t be able to decrypt, it simply disconnects from APNs and sends an FCM push notification to wake up the Android app, which then connects to APNs, downloads, decrypts and processes the incoming message. BPNs can only tell when a new message is waiting for you - it does not have credentials to see or do anything else.

Bepper still connects on your behalf to run notifications while the app is not running.

My link is specifically talking about Mini; they indicate this behavior was on "the updated version of Beeper Mini".

This is incorrect. They're using a legacy, less secure protocol - not in the sense of encryption, but in the sense of the need to generate auth tokens per user.

>They're on the wrong side of history.

Say that to their market cap. Seems a lot of people appreciate what comes with that drawback. Revealed preferences can be a sonuvabitch.

Yep, this is an unpopular HN opinion, but I actually like Apple's walled garden. It's safe, it's friendly and I don't have to worry.

This is in fact the most popular HN opinion that always comes up on every Apple thread.

yep. And GP themself is an example of why this works. Their practices sold an iphone and converted a fanatic Android user!

I will say that to their market cap. Such an insane capitalization on digital sales can only be achieved by extinguishing the alternatives your platform can host. It's a regressive featureset that can (apparently) only be reversed through legislative demands a-la Digital Market Act.

Many, many companies have had huge market caps while funding anti-humanist or exploitative processes. Given Apple's scale you almost have to assume that they're abusing something lucrative.

> Such an insane capitalization on digital sales...

Apple's market cap is built on something like 80% hardware sales by revenue.

> while stifling competition

How? Lock-in, sure - but unless you do a lot of market gerrymandering (which Epic tried but got laughed out of court), how does anything apple do stop people competing?

It’s not e.g. paying google large sums of money to avoid making its own competitor. Being big isn’t itself anticompetitive.

And on this exact topic - there is a whole ecosystem of messaging apps that exists. They just have to build their own userbase.

SMS is spammy enough -- I don't want to see spam via iMessage. These third-party clients make spam much more viable.

I love open standards, open source, whatever, but I want some things in my life to just work well without caring about the details. My phone is one of those things.

If you want privacy a de-googled android phone is far better than apple.

Yes, but a truly de-googled Android phone is a huge pain. Many apps rely on play services, and the open source alternatives still don't fully work.

I've been using LineageOS with microg for over 2 years without much pain, other than initial setup.

I believe this to be true, but to be honest, back when I made the switch, I was also considering the convenience factor.

> The way Apple tries to lock you in though while stifling competition is extremely disappointing. They’re on the wrong side of history.

Fascinating that you say this when you literally switched to iPhone yourself.

How is it fascinating? Apple exerts pressure on customers to buy their products, and then further pressures to keep them integrated with Apple's ecosystem. Here, a customer gave in to the first pressure and is disappointed by the artificial friction Apple uses to upsell their customers.

So... are we shocked that iPhone customers don't de-facto agree with everything Apple does? Or the fact that OP would be willing to criticize something they paid for and supposedly identify with?

It's really not fascinating at all. It reads like a perfectly level-headed and candid criticism of an ecosystem by someone who isn't invested in the success of one particular company. It's almost too lucid for HN.

Reply on news.ycombinator.com