Apple cuts off Beeper Mini's access • Hacker News Board

Re: Apple cuts off Beeper Mini's access

#421

Post by scatters » Sat, Dec 09, 2023, 1:13 AM UTC

georgespencer wrote: post #364

maxlin wrote: post #277

Earlier quoted context omitted.

It's not a super serious comment, it's more about how ridiculous the tone of "We are doing this for YOUR protection" would be. On a more serious note though, in the end Apple absolutely has the power of increasing everyone's capability and security by doing something like setting up a playbook of how iMessage could just use Signal protocol and how other actors could join in, or really anything else but doing this.

> It's not a super serious comment, it's more about how ridiculous the tone of "We are doing this for YOUR protection" would be. Right now I can presume a basic level of device security across all iMessage threads I have. Beeper deranges that: E2EE is still there, but Beeper exposes my correspondence to device security weaknesses from other OEMs, malware, keyloggers, screen scrapers, etc. as a result of lax app marke…

Does Apple block imessage on rooted phones? If not, what level of device security do you really have?

Re: Apple cuts off Beeper Mini's access

#422

Post by mirashii » Sat, Dec 09, 2023, 1:13 AM UTC

conradev wrote: post #407

ribosometronome wrote: post #389

Earlier quoted context omitted.

>Of course, it's very unlikely Apple is doing that. Just putting the thought out there. Is making wild claims and then immediately trying to disavow them in the next sentences the hacker spirit? How does it at all follow that Beeper Mini is using encryption properly (or else it wouldn't work) but it's unlikely Apple is? How would Beeper have been able to reverse engineer it if Apple's not using it? Who did they model…

Is implicitly trusting authority the hacker spirit?

And by implicitly trusting authority, you mean trusting the device manufacturer with billions of sales and intense scrutiny from security researchers and state actors spanning decades, right? You mean trusting the entire of the security industry to have managed not to miss this glaring and easy to detect invasion or privacy? This isn’t “it’s not happening because Apple promises it’s not”. This is one of the most scrutinized platforms in the world. Making wild claims and disavowing them immediately is lazy rhetoric, just as oversimplifying this as an appeal to authority is lazy rhetoric.

Re: Apple cuts off Beeper Mini's access

#423

Post by prmoustache » Sat, Dec 09, 2023, 1:13 AM UTC

haswell wrote: post #194

StressedDev wrote: post #143

One thing which is really confusing is why are Android users obsessed with iMessage? Android users can send text messages to iPhones, the can call iPhone users, and they can use third party messaging apps to communicate with iPhone users. It really isn’t clear to me why so many people are so angry they cannot use iMessage on Android.

An android user in an otherwise iMessage only group chat tends to mess things up. Those Apple users tend to get frustrated by it and group chat exclusion is a real thing. It’s less about a specific feature set and more about inclusion and acceptance from/by peers. This is especially prevalent among the younger crowd. Think high school group dynamics playing out with phones. And then on top of that, photos/videos are…

Are these iMessage group chat really a thing?

In my part of the world Whatsapp is the defacto standard for group chat and even for things like scheduling anpointment to a doctor/dentist/hairdresser.

And that is because it is available on android, apple devices and even those cheap kaios halfsmartphones.

Re: Apple cuts off Beeper Mini's access

#424

Post by goodluckchuck » Sat, Dec 09, 2023, 1:13 AM UTC

School-Cotton wrote: post #101

goodluckchuck wrote: post #86

Earlier quoted context omitted.

It looks to me like there is an advantageous business relationship between Beeper and their customers. As a general rule, Apple is free to change their programs and how they work. However, I think there’s a plausible argument for tortious interference here if the sole purpose was to prevent interoperability.

Are you a lawyer because Apple stopping third parties from using their service being in any way illegal sounds extremely hard to believe

That’s fair, but compare it to SMS. What if Apple blocked SMS messages sent via cellular carriers, which are also using their services (software on phones, etc.) Then suppose it wasn’t malicious SMS or spam, but legitimate messages sent using a competitor’s product (e.g. from all Samsung phones).

Re: Apple cuts off Beeper Mini's access

#425

Post by pxeboot » Sat, Dec 09, 2023, 1:14 AM UTC

lelandbatey wrote: post #402

pxeboot wrote: post #350

Earlier quoted context omitted.

And Apple didn't even need to block any device identifiers, just the IPs Beeper Mini was using to connect to the APN service. This could have been blocked in minutes. The delay was likely to get approval from Legal.

I think you've got Beeper Mini mixed up with other iMessage bridges. The whole thing with Beeper Mini (vs other iMessage bridges) was that it was entirely client side on the phone, no server to block. So the "IPs Beeper Mini was using to connect to the APN service", those IPs were just the IP addresses of every individual phone with Beeper Mini installed on it, no centralized place to block.

If you check the How it Works post, they do show the Beeper Push Notification Service running in the cloud [1] to intercept 'new message available' APNs and then notify the Android device a new message is available.

[1] https://blog.beeper.com/p/how-beeper-mini-works

Re: Apple cuts off Beeper Mini's access

#426

Post by lelandbatey » Sat, Dec 09, 2023, 1:14 AM UTC

georgespencer wrote: post #364

maxlin wrote: post #277

Earlier quoted context omitted.

It's not a super serious comment, it's more about how ridiculous the tone of "We are doing this for YOUR protection" would be. On a more serious note though, in the end Apple absolutely has the power of increasing everyone's capability and security by doing something like setting up a playbook of how iMessage could just use Signal protocol and how other actors could join in, or really anything else but doing this.

> It's not a super serious comment, it's more about how ridiculous the tone of "We are doing this for YOUR protection" would be. Right now I can presume a basic level of device security across all iMessage threads I have. Beeper deranges that: E2EE is still there, but Beeper exposes my correspondence to device security weaknesses from other OEMs, malware, keyloggers, screen scrapers, etc. as a result of lax app marke…

If more users are sending encrypted messages over APNS instead of SMS (remember, SMS is effectively unencrypted plaintext), that sounds like the definition of "more security".

Hmmming and hawing over "OEMs... and ...lax app marketplace security" seems like quite a high bar to hold, a bar so high it ceases to be useful. Remember, iPhone users can disable passwords on their iPhone entirely; if that's not something you ever worry about, then worrying about a minority of OEM's seems like mere pretext to keep your comfy walled garden all to yourself.

Re: Apple cuts off Beeper Mini's access

#427

Post by zxt_tzx » Sat, Dec 09, 2023, 1:15 AM UTC

pxeboot wrote: post #350

llm_nerd wrote: post #290

This was the obvious outcome. People were being willfully blind about how this "hack" works. Using an exfiltrated binary they used its blackbox functions to perform a sort of device attestation using ripped Apple device identifiers. Clearly Apple simply needs to blacklist any device attestation that this service uses, which is obviously trivial. These aren't just RNGs they're fabricating, they're sets of legitimate A…

And Apple didn't even need to block any device identifiers, just the IPs Beeper Mini was using to connect to the APN service. This could have been blocked in minutes. The delay was likely to get approval from Legal.

> just the IPs Beeper Mini was using to connect to the APN service.

Hmm, wouldn't blocking IPs be overly broad and risked affecting regular users? Considering that IPs are scarce and constantly recycled by ISPs etc. Blocking device identifiers sounds more targeted and, for that reason, realistic.

Re: Apple cuts off Beeper Mini's access

#428

Post by not2b » Sat, Dec 09, 2023, 1:15 AM UTC

schrodinger wrote: post #128

not2b wrote: post #74

Earlier quoted context omitted.

That's probably why Apple will get away with keeping iMessage closed (unless the US government pushes them), probably not enough European use to count as a gatekeeper.

You say that like it's a bad thing ("get away"). iMessage has nowhere near a majority and Apple doesn't put in any restrictions against alternative messaging software (…not that they're perfect, and haven't in other areas…).

I don't believe in closed protocols or crappy interoperability. There are several approaches that could improve things, like adopting Google's encryption improvements to RCS so that mixed iPhone/Android conversations are secure ("but that's not in the standard!", well, then, get it or something similar in the standard); they don't have to let others into iMessage necessarily. Apple claims to care strongly about their users' privacy and correctly attacks Google for caring a whole lot less. Encrypted, full-featured messaging would benefit their own users.

Re: Apple cuts off Beeper Mini's access

#429

Post by theshackleford » Sat, Dec 09, 2023, 1:15 AM UTC

ysofunny wrote: post #319

CharlesW wrote: post #167

Earlier quoted context omitted.

Keep in mind that this is spin — Erik's statement is ridiculous, and he knows it. To think that Apple would somehow not treat Beeper like any other bad actor hacking iMessage protocols is delulu.

but the real problem some of use have with Apple's behavior is the real underlying reasons they're doing this I am reasonably sure that their main driver is profit which really means exploitation of people; I consider their public arguments lies made up to cover up the fact that what they account for as profit comes from what are in the end some really ugly historical and traditional imperialistic (colonial, neocolon…

I’m poorer for having read this unsubstantiated drivel.

Re: Apple cuts off Beeper Mini's access

#430

Post by inoop » Sat, Dec 09, 2023, 1:15 AM UTC

Pulcinella wrote: post #412

somebodythere wrote: post #347

Earlier quoted context omitted.

No one is literally spitting, but Apple intentionally creates enough friction that Android users really do regularly get excluded from group chats in the US where iMessage is the convention for group chats.

Chat app friction is not being spat on which is what the OP literally said. Perceived inconvenience is not persecution.

You may not have ever experienced this yourself, but it's a known cultural phenonemon. Here's a New York Times article: https://www.nytimes.com/2023/11/29/technology/personaltech/a...

> Over time, the annoyance and frustration that built up between blue and green bubbles evolved into more than a tech problem. It created a deeper sociological divide between people who judged one another by their phones. The color of a bubble became a symbol that some believe reflects status and wealth, given a perception that only wealthy people buy iPhones.

...

> On dating apps, green-bubble users are often rejected by the blues. Adults with iPhones have been known to privately snicker to one another when a green bubble taints a group chat. In schools, a green bubble is an invitation for mockery and exclusion by children with iPhones, according to Common Sense Media, a nonprofit that focuses on technology’s impact on families.

> “This green-versus-blue issue is a form of cyberbullying,” said Jim Steyer, the chief executive of Common Sense, which works with thousands of schools that have shared stories about tensions among children using messaging apps.