Well not sure about Sunbird. Beeper advertises this also but it’s not entirely untrue. It’s E2EE from the sender to your Beeper server, where it’s decrypted, then re-encypted as a Matrix message. But it’s all open source so you can see what’s going on.
You can get around this vulnerability by hosting your own Beeper server.
While it’s a good solution, it is entirely untrue. A message is either End to End Encrypted or it is not. If the message is decrypted at any point between the sender and the intended recipient, it is definitively not End to End Encrypted.
E2EE means it’s End-to-End Encrypted. If it’s decrypted at any point during transit then it’s by definition not E2EE and Beeper shouldn’t be making that claim.
Sticking two E2EE tunnels together with a plaintext middleman doesn’t result in a single E2EE tunnel.
The reason the distinction is important is because the security profile is vastly different—a compromised server leads to a compromised message—which isn’t true for actual E2EE services like a pure Matrix link.
Side note: the first thing you should ask of a “end-to-end encrypted” product to you is “which ‘ends’ do you mean?” I’ve seen TLS advertised as E2EE before.
Adding: TLS is actually a pretty apt analogy here.
You could make a chat server that just accepts plain text messages over a TLS link, and that’s basically the same security topology as with this Beeper bridge.
As someone who works in the tech industry, this is not surprising to me at all. Typically the people who communicate with the media and customers don’t know a single thing about tech. They don’t know what end to end encryption means. They know just know encryption is involved and they have heard the buzzword, so they repeat it.
It’s bizarre that Sunbird touted their solution as end-to-end encrypted, when it can’t be - iMessage drops to plaintext on the Mac farm.
Well not sure about Sunbird. Beeper advertises this also but it’s not entirely untrue. It’s E2EE from the sender to your Beeper server, where it’s decrypted, then re-encypted as a Matrix message. But it’s all open source so you can see what’s going on.
You can get around this vulnerability by hosting your own Beeper server.
While it’s a good solution, it is entirely untrue. A message is either End to End Encrypted or it is not. If the message is decrypted at any point between the sender and the intended recipient, it is definitively not End to End Encrypted.
deleted by creator
It’s not though. It’s still encrypted from beginning to end. It just changes encryption in the middle.
You can’t change encryption in the middle without decrypting, however briefly.
It’s encrypted at the beginning and at the end, but NOT from beginning to end.
E2EE means it’s End-to-End Encrypted. If it’s decrypted at any point during transit then it’s by definition not E2EE and Beeper shouldn’t be making that claim.
[This comment has been deleted by an automated system]
Except you’re not because your decrypted messages aren’t stored anywhere.
[This comment has been deleted by an automated system]
Good points all around
Then it’s not E2E encrypted.
One end is your device, the other end is the other device. It’s only E2E encrypted if it is not decrypted until it reaches the other device.
Yes. It is.
Sticking two E2EE tunnels together with a plaintext middleman doesn’t result in a single E2EE tunnel.
The reason the distinction is important is because the security profile is vastly different—a compromised server leads to a compromised message—which isn’t true for actual E2EE services like a pure Matrix link.
Side note: the first thing you should ask of a “end-to-end encrypted” product to you is “which ‘ends’ do you mean?” I’ve seen TLS advertised as E2EE before.
Adding: TLS is actually a pretty apt analogy here.
You could make a chat server that just accepts plain text messages over a TLS link, and that’s basically the same security topology as with this Beeper bridge.
But no one would call that a E2EE chat.
deleted by creator
How does one host their own beeper server?
Edit: found it
https://github.com/beeper/self-host
As someone who works in the tech industry, this is not surprising to me at all. Typically the people who communicate with the media and customers don’t know a single thing about tech. They don’t know what end to end encryption means. They know just know encryption is involved and they have heard the buzzword, so they repeat it.