Let me edit in one more relevant info:
I don’t use it, but my contacts may or may not use it.
For those who don’t know, Beeper is an app that aims to unite all your messaging apps into one. To do this, it makes use of Matrix, bridging all those services together. So far, so cool.
However, since different services often use different encryption protocols, messages between those services and Matrix have to be decrypted on Beepers’ servers, before being re-encrypted with the protocol of the recipient.
They are completely open and transparent about this (which I can very much respect), and state that chats on their servers are encrypted, so they can’t read them.
Still though, decrypting mid-transit kinda throws the whole end-to-end part out of the window.
Some might say that everyone needs to decide for themselves if that’s a problem. But the issue with that is that if you decide to use Beeper, you also decide that every person you chat with is okay with it. Not very cool in my book.
That’s where the question asking for independant audits comes in, because I certainly don’t have the expertise to look at their code. If everything is safe from attackers, then cool.
But me for example, I switched to Signal specifically for verifiable and proper End-to-End Encryption, so chatting with someone who uses Signal through Beeper kinda defeats the point.
Because, how does Beeper even get what they need to decrypt a message I send to a Beeper user?
I don’t consent to a third party decrypting my messages, simply because one of my contacts uses their service. That is fundamentally wrong in my opinion.
What are your thoughts on this?
I think this is an issue for any messenger, not just those tied to the beeper service. E2E encryption only covers transmittal of the message, and you can’t control what the recipient does once they get it… What if the recipient has no passcodes on their phone, no disappearing messages, and the phone gets stolen? Whoever stole the phone now has access to all of your messages even when using a fully E2E encrypted messenger like signal.
If you’re using any messenger for highly sensitive conversations you need to have trust in the recipient. Just have a conversation that they’re either not using a service like this, or like others said are choosing to self host it in a safe manner.
I fully agree with the sentiment. The recipient is the last, but most important link in the chain to trust with the contents of my message.
But that doesn’t mean we can devalue the other parts of the chain. I need to be able to trust them, too. So if messages are being decrypted by a third-party without my knowledge, that’s a problem.
I guess what I’m saying is that if the recipient chooses to use Beeper, the chain ends there though… Signal did its job and delivered an encrypted message, and you can’t control that the recipient gave decryption keys to Beeper.
Both Signal and Beeper aren’t doing anything inherently wrong, but if you don’t trust messages passing through beeper servers you need to have that conversation with the recipient.
It just seems very wrong that some random service can decrypt my messages. Like, what.
Beeper being able to do that without consent from both contacts is very wrong to me, at least.
Signal should be firmly against this, seeing how they already proclaimed being against interoperability, but what do I know.