Hacker News Reader

Comment by Contortion | Hacker News Reader

Plus your messages will no longer be fully E2E encrypted. As per their FAQ (emphasis mine):

"For example, if you send a message from Beeper to a friend on WhatsApp, the message is encrypted on your Beeper client, sent to the bridge, which decrypts and re-encrypts the message with WhatsApp's proprietary encryption protocol."

Directly underneath that they also say:

"Using native end-to-end encrypted chat apps independently may be more secure than connecting to them to Beeper"

https://www.beeper.com/faq#how-does-beeper-connect-to-encryp...

View on HN

What do you mean "no longer"? Beeper has always behaved like this.

No longer as in for a new user that currently uses individual apps.

In context your use of "no longer" is very confusing. This thread is talking about what might change in Beeper as a service, if you want to interject with information about how the service currently works there are other phrases that would have made that clearer.

You are correct. I was adding what I considered extra privacy-relevant information in response to GPs statement about WordPress sharing data with other companies, but the fact that I'd not heard of Beeper before unintentionally influenced my word choice.

You can host the bridges yourself:

https://github.com/beeper/bridge-manager

Still won't be E2E as per their FAQ

that FAQ is accurate but (rightly) doesn't cover high-security deployments.

if I'm running the bridges local-to-the-client (I am, on my McBook) it's not meaningfully any less e2ee. encryption happens in the matrix client (running on the laptop), the encrypted message is sent to the homeserver on localhost, the bridge (on localhost) grabs the encrypted message and decrypts it, then the bridge re-encrypts it and sends it to Whatsapp (or wherever). the content of the message is as secure over the wire with this approach as using first-party apps directly

if one hosts their own bridges they're person-in-the-middling themselves and should take all the necessary precautions. if they're using beeper's hosted options they have to delegate read/write ability to beeper (though I think the signal and imessage bridges might be device-local), and beeper is clear about that.

But at least you are in control of the computer where the decryption and re-encryption is happening.

They usually call it E2B (end to bridge)

Seems like an insane amount of work for the satisfaction of only having to check one chat app.

I think you underestimate how painful wrangling the proliferation of chat apps can be!

Another application is resource-constrained devices. I love the netbook form-factor, but my little Intel N200 machine buckles under the strain of running what amounts to six web browsers simultaneously (because everything is Electron now) in order to receive notifications from all the chat networks I have people on.

It can also be nice to have a kind of buffer layer in between you and the chat network, which doesn't necessarily have your interests in mind. For example, Facebook Messenger's Android app somehow managed to wake up my phone's screen every time it received a notification, despite my turning off every related setting and permission I could find. So I put it behind Beeper and the problem is gone.

Reply on news.ycombinator.com