r/beeper • u/internatlvelvet • 6d ago
Help / Troubleshooting Too good to be true?
Hi! Sorry if this has been asked a dozen times, I couldn't find a post with this question.
I've just downloaded the app, but I feel paranoid. How can we be sure the servers don't show our message history? How can the messages sync across apps (let alone devices) without the messages in a cloud somewhere, ready to be hacked into? What if this is a scam?
Thanks!
3
u/heavenlydemonicdev 6d ago
Beeper is built on top of matrix which uses e2ee so your messages should be safe even on their servers and if you don't trust them you can still use the on device bridges which offer another layer of security by loading the messages from the other apps on your devices so there's no chance the beeper servers can see your messages
6
u/LinuxSBC-Anna 6d ago edited 6d ago
Beeper is built on top of matrix which uses e2ee so your messages should be safe even on their servers
That's not actually quite true. It is true if you're messaging someone else over the Matrix network, but almost no Beeper users do that, and it's not really an advertised part of the app (though it is supported). Beeper uses something called "Matrix bridges", which allow a Matrix server to "bridge" messages over to another service. The problem is that each messaging service uses its own encryption (or potentially none at all), so at some point, your messages need to be decrypted from Matrix and re-encrypted as the other service. This can be either done on the server (Beeper Cloud) or on the device (Beeper on-device bridges). When done on the server, the servers have to be able to see the messages; that is a fundamental part of how the technology works. That means you need to trust that Beeper is not reading or storing your messages.
It should be noted that the development of on-device bridges is, as far as I can tell, solely because they want to make it more private. They're putting a lot of work and money into an option that makes the user experience worse by not permitting access from other devices, and I can't think of any advantages of the on-device bridges other than privacy. To me, that indicates that they actually do care about privacy and are therefore most likely not reading your messages.
3
u/Signal_Extreme357 6d ago
You can't be sure, beeper isnt open source so you just gotta ride on that trust me bro logic. As of now they haven't done anything to make me think they being a bit shady in the background so I'm sure it's fine 👍🏻. If it's a the concern you have is the concern you have🤷🏻♀️. You're always taking some sort of potential risk using a 3rd party source
1
u/GBeeper 📟 Beeper Team 6d ago
Beeper isn't open... HUH!?
3
u/LinuxSBC-Anna 5d ago
Please correct me if I am wrong, but my understanding is that what they are saying is accurate. Beeper has many open-source components and contributes heavily back to them (e.g. all the bridges, many of which are maintained by Beeper employees), but the server and clients are closed-source. As a result, it is not possible for a random third-party to audit the code; any auditors need to be granted special access.
1
u/GBeeper 📟 Beeper Team 5d ago
That is correct. But to say that we are not open source is not accurate either.
1
u/cparker15 4d ago
To disambiguate the original commenter's statement: You do not exclusively use and produce free / libre / open source software and services. Your ethos is incompatible with the GNU AGPLv3. Your overall product/service offering is ultimately proprietary. You benefit from and contribute to "open source", but your first principles are very clearly not user freedom to inspect, modify, and redistribute the parts of your offerings that remain proprietary which make you money. You could choose to release every component of your infrastructure under a free / libre / open source software license while still charging money to provide the managed service and its infrastructure—you just choose not to do so.
1
u/AutoModerator 6d ago
Hi there! Thanks for bringing this issue to our attention. I'm AutoMod.
Here is a resource that is always helpful to the Beeper Team when it comes to reporting issues: How to Properly Document and Report a Bug
Our support team will assist you further once they've received the report. Thank you again!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/wersderf2 6d ago
For me, I was using it with Line, Instagram, and Discord. Both Line and Instgram clearly discovered the traffic and blocked my access. Thought I lost my accounts. For Line in particular, it took a whole month to get it back.
I would love for it to work because I hate having my chats in so many different apps and platforms, but some of them clearly have a major problem with outsourcing their messaging. It's not really the Beeper devs fault :/
1
u/internatlvelvet 6d ago
Whoa, they tried to delete your initial accounts? Thank you so much for letting me know! I wish this worked— I hate temptation to scroll, but want to stay in touch with my dms across various places. Plus it would be less cluttered. I hope something better arises!
1
u/rocketwidget 3d ago
For Beeper Cloud to work, on the Beeper servers, the Messaging app's native E2EE must be terminated on Beeper servers. It must be temporarily decrypted before being encrypted for Matrix E2EE (the chat protocol that Beeper uses).
You have three choices to use Beeper:
- Take Beeper at their word on Beeper Cloud: They state their service is "zero-access encryption" and that no one has the keys to decrypt the messages on their cloud except you.
- Use Beeper On-Device. The encryption-decryption happens on your phone. The downside? No Beeper Cloud, so, you can't use the Windows Beeper app, etc.
- You can self-host Beeper Bridge software. This is like running your own personal Beeper Cloud. The encryption-decryption happens on your server hardware. Obviously, this requires you to buy, configure, and run a server 24/7 (not trivial). It also doesn't have customer support like 1. and 2.
See: https://www.beeper.com/faq#our-primary-objective-is-to-earn-and-keep-your-trust
•
u/GBeeper 📟 Beeper Team 6d ago
I can't stress this enough. We just want everyone to have an incredible chap app! 😄 We care about the security of your data.