Every attempt at iMessage on Android has been awful—at best the implementation is complicated
and unreliable—and at worst, it's a downright security disaster. But there's a new app—available
starting today—that is vastly different from every attempt before it: you don't need to hand
over your Apple ID credentials to anybody because this isn't some sketchy relay running on a macOS
virtual machine in a data center somewhere... it's a complete reverse engineering of the entire
iMessage tech stack registering your Android's phone number for native blue-bubble support;
with no middle-man in between. Here's how it works once you download and open the app:
1. Sign in to your Google account to verify subscription status through the Play Store
2. Enable notifications 3. Sign up—if you haven't—for
the $2/mo subscription following a 7-day trial 4. Enable on-device permissions to import your
previous SMS conversations and your contacts list 5. Start using iMessage. That's it.
If this sounds too good to be true, I don't blame you, but let me explain everything you
need to know... This new app, Beeper Mini, will be the future replacement for Beeper
Cloud—formerly known as Beeper—an app that has integrated a bevy of chat services into one,
centralized place. Started by Pebble founder and CEO, Eric Migicovsky, Beeper is open-source and
supports end-to-end encryption, but has been mostly cloud-based—requiring you to host your
own bridges, or, utilize Beeper's. Until today, just like Sunbird, Nothing Chats, AirMessage,
and others... Beeper would (1) ask for your Apple ID, (2) create a new macOS virtual machine on a
real Apple computer in a data center, (3) login to that Mac using your Apple ID, (4) and then
relay the messages through that Mac to your Android phone to "pretend as though
you were an iPhone." Now, Beeper did this a lot more securely than Carl Pei's disastrous,
negligent, no-good-very-bad Nothing Chats app that allegedly stored iMessages in plain text
on the internet (what the hell, Carl), but users were ultimately still trusting that
Eric and the folks at Beeper weren't going to abuse that access. Not a great system.
Beeper Mini flips that idea on its head doing everything client-side;
inside of the Android app—no third party! Your messages, sent directly through Apple,
to the recipient, and back—as if you were a literal iPhone. So what team of geniuses
figured out how to do the impossible? A single high school student—nicknamed
JJTech. Back in August, they published the open-source proof-of-concept, pypush,
that Migicovsky purchased in order to create the foundation of the all new Beeper. There's really
no better demo than pypush to show you how Beeper Mini —and frankly, iMessage itself works. I will
run this demo on my System76 Linux machine to prove it has nothing to do with Apple hardware.
After a git request and an installation of needed dependencies, I can open pypush in
a command line window and I'm immediately shown as being connected to Apple's Push Notification
Service or APNs. If you're an iOS or macOS developer, you know this well... iMessage uses
the same service to receive notifications as apps found on the App Store. But what's lesser known
is that APNs are bidirectional. This will come in handy once we request an authentication token
from Apple by entering our Apple ID, password, and 2-factor code which shows my real location because
my laptop is logging in—not some data center. This token is immediately exchanged for a longer-term
certificate that allows our device to request registration with Apple's identity service.
Encryption and signing keys from our device are uploaded to Apple's keyserver along with
something super important: a "validation data" blob that Apple uses to—surprise, validate Apple
hardware—aka, to make sure you're not... oh, I don't know, running this on an Android phone. The
pypush Github repo comes with a file that includes a serial number and hardware UUID already that's
bundled up into that needed "validation data" blob to tell Apple, falsely, "hey, we're legit."
Now you may be thinking "well, couldn't Apple just ban that specific serial and UUID server-side and
break pypush in like 2 minutes? Yes, they could. BUT, they aren't likely to. There are a lot of
legitimate reasons for many Apple IDs to use the same hardware keys—from enterprise deployments to
white hat bounty programs. In fact, Apple uses a bunch of unknown variables, weighted differently,
to determine the legitimacy of you as a user beyond just the serial number—up to and including
your Apple ID, phone number, and history as an Apple customer. Hackintosh users know this well
because they use completely BS, fake serials all the time and Apple goes "okay," cool, thanks! And
in the event your Apple ID is brand new, they don't put any value into you as a customer yet,
and your heavily weighted serial turns up bogus and is rejected, there are tools that will just
generate new serial after new serial after new serial until you find one that's actually
tied to a legit Mac that exists in the world—it doesn't take as long as you'd think. And then,
Apple has no way of knowing if you own the computer or not. At least not currently.
Needless to say, this doesn't appear to be some easy thing Apple can just turn off—it
will require a complete re-design of their entire authentication and
delivery strategy for not just iMessage but Apple ID account access as a whole.
Back to pypush. Once our session is setup, we can now look up the public
keys of someone via phone or email to see if they have iMessage. Once its determined
they do... we can send them a message, and they can respond in kind! Again,
this is using keys and certificates on-device. On this computer. And that's the foundation of
Beeper Mini. But Beeper Mini is a lot more than just a command-line tool.
For starters, as mentioned previously, turning over your Apple ID is not required. The
Beeper team figured out how to register Android phone numbers with iMessage—no
Apple hardware required—at all. Instant green-to-blue bubble conversion. That said,
you can login to your Apple ID if you'd like to use an email instead of phone number,
or, to send and receive using other Apple devices like iPad or Mac. Just with pypush,
Beeper states your credentials are sent directly to Apple for enrollment and then the certificate
and keys are stored strictly on-device. The only involvement Beeper has outside of what a normal
iPhone might is handling notifications. Because Apple's APNs require a persistent connection (and
that they can because they're built into the literal operating system), Beeper couldn't be
a reliable messaging app without running in the background 24/7. To continue supporting
push even when the app is closed, Beeper built an APN to BPN (Beeper Push Notification) bridge for
use when Beeper Mini isn't running. They connect to Apple's servers on your behalf to listen for
notifications and then push them through Android's FCM notification system. Beeper states they can
do this while maintaining complete privacy because they only receive push credentials
that don't give access to message content; but do allow them to nudge the Beeper Mini Android
app to (1) open in the background, (2) have your phone send the keys to Apple, and (3) download,
decrypt, and process incoming messages. Though they explain this in their documentation and state
its security, they do also let you disable them entirely if you're not comfortable with the idea.
"OK that's great and all, but I'm not a nerd... what can the app actually do?"
I've been using a pre-release version of Beeper Mini for several days now and it's
surprisingly polished. Given that it's actually iMessage it does the stuff you'd expect iMessage
to actually do. It supports not just one-on-one messaging, but also group chats—with group chat
titles and participant lists. High resolution images and video can be sent and received. You
can edit messages and you can also unsend them. Read receipts are sent and received,
typing indicators are supported, as are tapback reactions. You can reply to threads,
there's native support for sending and receiving voice messages. Stickers and GIFs work, and more.
Now there are a few small things missing—it'll suggest you share your contact info like on iOS,
but instead of doing what an iPhone would do, it just sends your contact vcard. It works,
but it's... not quite as elegant. There's no live location sharing (yet, says Beeper), there are
no message effects, and obviously, there's no support for FaceTime audio and video (though,
perhaps Beeper could integrate a web-view or something cause it kinda is supported by Apple
on Android. Really, the only thing the Beeper doesn't think will ever be supported is iMessage
games and well, duh, that makes sense—because that's all facilitated though the iOS App Store.
It's a very, very reliable 1.0, but it's clearly a 1.0. Beyond the features I listed,
you can mark messages as unread and mute threads, but that's basically it. There's no support for
standard SMS or RCS—you'll still need Google Messenger or an alternative app for that,
but it is coming apparently. Eric tells me Beeper will be working on moving the
rest of their 15 messaging services from their original app into Beeper Mini's new
architecture over time and when the transition is complete, Beeper Mini will be renamed to
Beeper and the Beeper of yesterday—which is now called Beeper Cloud—will disappear.
I had some more questions for Eric like... is this legal? I mean, surely harvesting macOS hardware
keys in order to circumvent Apple's entire authentication system violates some sort of EULA,
no? And while they might turn a blind eye at some high schooler doing it for fun,
they might not be so forgiving if its a well-known Silicon Valley entrepreneur
monetizing the workaround. While I suppose Eric can't be sure Apple won't bully him
with a civil case, he feels pretty confident in the protections afforded by DMCA section
1201 F which states reverse engineering for the purposes of interoperability is
protected. And I don't know if there's a better example of that than Beeper Mini.
Frankly, one of the things Eric mentioned that really struck a cord is that this isn't just a
way to bring blue-bubbles to broke boy Android users—it's a way to improve the messaging
experience and security for Apple's own users. Apple has intentionally made messaging Android
users a horrible, insecure experience—it's why the green bubble thing is a thing. Apple execs talked
over 10-years-ago about bringing iMessage to competing platforms but many feel Apple avoided it
for fear of losing customers to Android. If Apple did feel that way, it was irrational and stupid;
it was then and it continues to be because iOS has oodles of amazing features worth staying for. And
if iMessage really is the only thing keeping users on this side of the aisle, boy, Apple's
screwed cause this won't continue on forever. Now yes, Apple is bringing RCS to iOS next year,
but they're not implementing Google's flavor of RCS with E2EE. They're adopting the older,
dated version supported by the GSMA and Apple will be working with them over the
coming years to bring E2EE to the standard as a whole. I think that'll be a good thing when
it happens but that's not going to happen tomorrow, next month, or probably even next
year. You can get a better experience than next year's RCS, today—and I think that's wicked cool.
Now, a word of disclosure... while Eric has a stellar reputation, has open-sourced Beeper
Cloud and will maintain pypush as an open source project, the Beeper Mini client is
not open source and while they invite security researchers to verify their claims and published
an internal red-team analysis, there's always a potential risk when it comes to using third party
apps like this to login to services without open authorization like iCloud. If you're interested,
you can check out Beeper Mini using links in the description below. It's available now,
doesn't have any sign up limits, and doesn't have any ads or tracking but does require
a paid subscription. This video hasn't been sponsored, no money has or will change hands,
but I just think it's really cool and I'm excited for a more unified future. Thanks
so much for watching—I don't care if you think WhatsApp is better—and as always, stay snazzy.