Beeper ready to wave white flag if its latest iMessage fix gets shut down

@rhythmisaprancer @ijeff @Chozo @KLISHDFSDF @sour

pretty sure they removed sms support

Used to but not anymore. Anything sent over Signal is guaranteed to be secure. SMS/RCS doesn't provide any guarantees as SMS is not encrypted by default and RCS clients are all closed-source.

Yeah, like a telephone call. But, not a telephone call.

IP-based internet relies on so many corporations, organizations, governments, etc., to play nicely. They hoard IPv4 ranges and let you "rent" out blocks of IPs if you pay them enough. This is not free and open access to the internet.

In order to connect to the internet, you are required to pay an ISP. They then dictate how you can use your service. For some residential ISPs, you aren't allowed to use certain ports, so you cant host your own services like email, websites, etc. You also have to monitor how much bandwidth you are using to make sure you don't go over your "data cap". This is why these centralized services are so big for things like email and web hosting. We'll get more into data collection here in a bit.

IP-based internet is flawed in that it allows DDoS attacks to take out a server that might be limited on protection. There is no redundancy or self-healing properties built-in that will protect the little guy. You can always subscribe to services like CloudFlare, who will then Man-In-The-Middle your internet traffic. You then have to abide by their terms of service, which is not desirable (especially if new hostile leadership were to come in and take over the company). Also, unless you are paying multiple ISPs for redundant connections to the internet backbone, you are vulnerable to Sybil attacks on your network. If subscribed to a single ISP, and it has downtime, you will have downtime along with them.

Any data sent between one IP to another is not encrypted by default. You have to bolt-on entirely different protocols to have that capability. As a result of that, we ended up with a very splintered implementation of encrypting data-in-transit. There are thousands of messenger applications, transmissions protocols, certificate authorities, etc., that often aren't compatible with others. They also individually have their own set of issues.

Data collection... Ads... Trackers. Oh my! The end user of most modern websites are connecting to multiple servers, even though they visited a single site. Those users are tracked as they hop website to website. Often, these companies keep a profile on anyone matching that fingerprint. You have no control over that data. If you turn off connections to those servers, the website can become unusable. You can't seriously say this is the best we can do. Why not have a network that prevents you from being tracked?

If you mean this link: that's a high level description of the protocol, but it leaves out important details.

For example, Google uses MLS for group chats, but the document only mentions the Signal protocol. In other words, E2EE for group chats is broken even if you manage to implement the protocol exactly as they describe.

For example, they say the client "registers with the key server" and "uploads the public key parts". What server is that? What protocol do we use? HTTPS POST? Do we use form/multipart? Do we encode the key in PEM or do we submit they bytes directly?

Another example: "Key material, digest, and some metadata are encrypted using the Signal session". Whay do you mean "some"? What algorithm is used to generate the digest?

The document is a nice high level overview, but worthless if you want to implement their protocol. It basically says "we put signal, and send the signal messages over RCS, with out own key servers. Here's how the Signal protocol works". If, for example, Ubuntu Touch would like to implement this into their messenger, they'll need to reverse engineer Google's Messages app, guided by the description in their whitepaper.