Every attempt at iMessage on Android has been awful—at best the implementation is complicated and unreliable—and at worst, it's a downright security disaster. But there's a new app—available starting today—that is vastly different from every attempt before it: you don't need to hand over your Apple ID credentials to anybody because this isn't some sketchy relay running on a macOS virtual machine in a data center somewhere... it's a complete reverse engineering of the entire iMessage tech stack registering your Android's phone number for native blue-bubble support; with no middle-man in between. Here's how it works once you download and open the app: 1. Sign in to your Google account to verify subscription status through the Play Store 2. Enable notifications 3. Sign up—if you haven't—for the $ 2/mo subscription following a 7-day trial 4. Enable on-device permissions to import your previous SMS conversations and your contacts list 5. Start using iMessage. That's it. If this sounds too good to be true, I don't blame you, but let me explain everything you need to know... This new app, Beeper Mini, will be the future replacement for Beeper Cloud—formerly known as Beeper—an app that has integrated a bevy of chat services into one, centralized place. Started by Pebble founder and CEO, Eric Migicovsky, Beeper is open-source and supports end-to-end encryption, but has been mostly cloud-based—requiring you to host your own bridges, or, utilize Beeper's. Until today, just like Sunbird, Nothing Chats, AirMessage, and others... Beeper would (1) ask for your Apple ID, (2) create a new macOS virtual machine on a real Apple computer in a data center, (3) login to that Mac using your Apple ID, (4) and then relay the messages through that Mac to your Android phone to "pretend as though you were an iPhone." Now, Beeper did this a lot more securely than Carl Pei's disastrous, negligent, no-good-very-bad Nothing Chats app that allegedly stored iMessages in plain text on the internet (what the hell, Carl), but users were ultimately still trusting that Eric and the folks at Beeper weren't going to abuse that access. Not a great system. Beeper Mini flips that idea on its head doing everything client-side; inside of the Android app—no third party ! Your messages, sent directly through Apple, to the recipient, and back—as if you were a literal iPhone. So what team of geniuses figured out how to do the impossible ? A single high school student—nicknamed JJTech. Back in August, they published the open-source proof-of- concept, pypush, that Migicovsky purchased in order to create the foundation of the all new Beeper. There's really no better demo than pypush to show you how Beeper Mini — and frankly, iMessage itself works. I will run this demo on my System76 Linux machine to prove it has nothing to do with Apple hardware. After a git request and an installation of needed dependencies, I can open pypush in a command line window and I'm immediately shown as being connected to Apple's Push Notification Service or APNs. If you're an iOS or macOS developer, you know this well... iMessage uses the same service to receive notifications as apps found on the App Store. But what's lesser known is that APNs are bidirectional. This will come in handy once we request an authentication token from Apple by entering our Apple ID, password, and 2-factor code which shows my real location because my laptop is logging in—not some data center. This token is immediately exchanged for a longer-term certificate that allows our device to request registration with Apple's identity service. Encryption and signing keys from our device are uploaded to Apple's keyserver along with something super important: a "validation data" blob that Apple uses to—surprise, validate Apple hardware—aka, to make sure you're not... oh, I don't know, running this on an Android phone. The pypush Github repo comes with a file that includes a serial number and hardware UUID already that's bundled up into that needed "validation data" blob to tell Apple, falsely, "hey, we're legit." Now you may be thinking "well, couldn't Apple just ban that specific serial and UUID server-side and break pypush in like 2 minutes ? Yes, they could. BUT, they aren't likely to. There are a lot of legitimate reasons for many Apple IDs to use the same hardware keys—from enterprise deployments to white hat bounty programs. In fact, Apple uses a bunch of unknown variables, weighted differently, to determine the legitimacy of you as a user beyond just the serial number—up to and including your Apple ID, phone number, and history as an Apple customer. Hackintosh users know this well because they use completely BS, fake serials all the time and Apple goes "okay," cool, thanks ! And in the event your Apple ID is brand new, they don't put any value into you as a customer yet, and your heavily weighted serial turns up bogus and is rejected, there are tools that will just generate new serial after new serial after new serial until you find one that's actually tied to a legit Mac that exists in the world—it doesn't take as long as you'd think. And then, Apple has no way of knowing if you own the computer or not. At least not currently. Needless to say, this doesn't appear to be some easy thing Apple can just turn off—it will require a complete re-design of their entire authentication and delivery strategy for not just iMessage but Apple ID account access as a whole. Back to pypush. Once our session is setup, we can now look up the public keys of someone via phone or email to see if they have iMessage. Once its determined they do... we can send them a message, and they can respond in kind ! Again, this is using keys and certificates on-device. On this computer. And that's the foundation of Beeper Mini. But Beeper Mini is a lot more than just a command-line tool. For starters, as mentioned previously, turning over your Apple ID is not required. The Beeper team figured out how to register Android phone numbers with iMessage—no Apple hardware required—at all. Instant green-to-blue bubble conversion. That said, you can login to your Apple ID if you'd like to use an email instead of phone number, or, to send and receive using other Apple devices like iPad or Mac. Just with pypush, Beeper states your credentials are sent directly to Apple for enrollment and then the certificate and keys are stored strictly on-device. The only involvement Beeper has outside of what a normal iPhone might is handling notifications. Because Apple's APNs require a persistent connection (and that they can because they're built into the literal operating system), Beeper couldn't be a reliable messaging app without running in the background 24/7. To continue supporting push even when the app is closed, Beeper built an APN to BPN (Beeper Push Notification) bridge for use when Beeper Mini isn't running. They connect to Apple's servers on your behalf to listen for notifications and then push them through Android's FCM notification system. Beeper states they can do this while maintaining complete privacy because they only receive push credentials that don't give access to message content; but do allow them to nudge the Beeper Mini Android app to (1) open in the background, (2) have your phone send the keys to Apple, and (3) download, decrypt, and process incoming messages. Though they explain this in their documentation and state its security, they do also let you disable them entirely if you're not comfortable with the idea. "OK that's great and all, but I'm not a nerd... what can the app actually do ? " I've been using a pre-release version of Beeper Mini for several days now and it's surprisingly polished. Given that it's actually iMessage it does the stuff you'd expect iMessage to actually do. It supports not just one-on-one messaging, but also group chats—with group chat titles and participant lists. High resolution images and video can be sent and received. You can edit messages and you can also unsend them. Read receipts are sent and received, typing indicators are supported, as are tapback reactions. You can reply to threads, there's native support for sending and receiving voice messages. Stickers and GIFs work, and more. Now there are a few small things missing—it'll suggest you share your contact info like on iOS, but instead of doing what an iPhone would do, it just sends your contact vcard. It works, but it's... not quite as elegant. There's no live location sharing (yet, says Beeper), there are no message effects, and obviously, there's no support for FaceTime audio and video (though, perhaps Beeper could integrate a web-view or something cause it kinda is supported by Apple on Android. Really, the only thing the Beeper doesn't think will ever be supported is iMessage games and well, duh, that makes sense—because that's all facilitated though the iOS App Store. It's a very, very reliable 1.0, but it's clearly a 1.0. Beyond the features I listed, you can mark messages as unread and mute threads, but that's basically it. There's no support for standard SMS or RCS— you'll still need Google Messenger or an alternative app for that, but it is coming apparently. Eric tells me Beeper will be working on moving the rest of their 15 messaging services from their original app into Beeper Mini's new architecture over time and when the transition is complete, Beeper Mini will be renamed to Beeper and the Beeper of yesterday—which is now called Beeper Cloud—will disappear. I had some more questions for Eric like... is this legal ? I mean, surely harvesting macOS hardware keys in order to circumvent Apple's entire authentication system violates some sort of EULA, no ? And while they might turn a blind eye at some high schooler doing it for fun, they might not be so forgiving if its a well-known Silicon Valley entrepreneur monetizing the workaround. While I suppose Eric can't be sure Apple won't bully him with a civil case, he feels pretty confident in the protections afforded by DMCA section 1201 F which states reverse engineering for the purposes of interoperability is protected. And I don't know if there's a better example of that than Beeper Mini. Frankly, one of the things Eric mentioned that really struck a cord is that this isn't just a way to bring blue- bubbles to broke boy Android users—it's a way to improve the messaging experience and security for Apple's own users. Apple has intentionally made messaging Android users a horrible, insecure experience—it's why the green bubble thing is a thing. Apple execs talked over 10-years-ago about bringing iMessage to competing platforms but many feel Apple avoided it for fear of losing customers to Android. If Apple did feel that way, it was irrational and stupid; it was then and it continues to be because iOS has oodles of amazing features worth staying for. And if iMessage really is the only thing keeping users on this side of the aisle, boy, Apple's screwed cause this won't continue on forever. Now yes, Apple is bringing RCS to iOS next year, but they're not implementing Google's flavor of RCS with E2EE. They're adopting the older, dated version supported by the GSMA and Apple will be working with them over the coming years to bring E2EE to the standard as a whole. I think that'll be a good thing when it happens but that's not going to happen tomorrow, next month, or probably even next year. You can get a better experience than next year's RCS, today—and I think that's wicked cool. Now, a word of disclosure... while Eric has a stellar reputation, has open- sourced Beeper Cloud and will maintain pypush as an open source project, the Beeper Mini client is not open source and while they invite security researchers to verify their claims and published an internal red-team analysis, there's always a potential risk when it comes to using third party apps like this to login to services without open authorization like iCloud. If you're interested, you can check out Beeper Mini using links in the description below. It's available now, doesn't have any sign up limits, and doesn't have any ads or tracking but does require a paid subscription. This video hasn't been sponsored, no money has or will change hands, but I just think it's really cool and I'm excited for a more unified future. Thanks so much for watching—I don't care if you think WhatsApp is better—and as always, stay snazzy.