Hacker News Reader

Comment by k8svet | Hacker News Reader

The Verge reports:

> Since then, Beeper has rolled out some security upgrades that change the way the app handles security and prevent Beeper itself from seeing unencrypted messages from Signal, WhatsApp, and other encrypted apps. Screenshots of Beeper’s desktop and mobile apps.

How?

View on HN

Beeper has been talking about running on-device bridges rather than server-side bridges. So presumably that would allow encryption to the user's device, then re-encrypted on-device to Matrix then sent to Beeper.

Wow, that's ... surprising.

Here's how it works: https://blog.beeper.com/2024/04/09/how-beeper-android-works/

This is exceptional effort and communication to build something cool. I'm very, very impressed.

Probably on device encryption before anything is sent through their servers

I'm sorry, but that's not an answer. WhatsApp encrypts the message E2E, and then Beeper is bridging it into Matrix. The only way this would make any sense is if they've bridged E2E all the way through to ... the clients? Like, it doesn't make any sense.

It's a journalist's take, they probably mean that Bleeper doesn't phone home the messages from the client.

Well, now I regret that this comment sounds a bit dismissive, if another reply is true and they run the bridge locally. That's... impressive, and still surprising to think about.

I'd honestly be fine with accepting the compromise of hosted bridges, especially since they seem to offer the ability to self-host the bridges, while using Beepers' Matrix infra. Gives them some extra cred in my book.

They actually reverse engineered Apple's iMessage and released a POC. At the time it worked and demonstrated on device bridges being a possibility. The runs locally and then encrypts it client side before it reaches beeper services. This can be enabled for Signal under experimental settings already.

https://blog.beeper.com/2023/12/05/how-beeper-mini-works/

There's an "experimental" option in the app to run the server locally. I don't use signal so not sure if it works as well

They break the terms of service of said services, they started this with iMessages last year and Apple shut them down after it was an obvious break of ToS, and they keep doing the same with other IM services.

Reply on news.ycombinator.com