pypush

Yeah, uh... you might do well to assume that they can. The Find My Friends API is really really simple, I have a script somewhere that can pull the locations of everyone who has shared their locations with me and record it. (I'm also the one who wrote the original code that was refactored a couple times until it became this project... https://github.com/JJTech0130/pypush/blob/async/examples/ope...)

The entire model was initially opensourced by a 16 year old. https://github.com/JJTech0130/pypush They modified it with their own touch.

Pretty sure you’re mixing up Beeper Cloud with Beeper Mini. Beeper Mini is based on pypush, which they’ve bought, and is clearly using spoofed data in the data.plist[0]. I’ve searched, but I’ve found no mention of them purchasing Mac Minis en masse to support the $2/mo Beeper Mini customer’s texting habits. Besides, it wouldn’t make sense anyway because they used to tout you didn’t need an Apple ID and instead could use your phone number, and non-iPhone IDs don’t allow for iMessage activation on phone numbers, only email addresses. 0: https://github.com/JJTech0130/pypush/blob/main/emulated/data...

There's much more to the validation protocol than just HWID/serial. See https://github.com/JJTech0130/pypush/blob/main/emulated/data... for a list of the data that is pulled from the platform and used for validation. I would assume that Beeper registrations either use data from a pool of real devices, or made-up data that Apple might "permit" (because hackintoshes) but can definitely detect and block at any time.

iMessage seems to use quite a lot of information from the hardware aside from the serial number. See https://github.com/JJTech0130/pypush/blob/main/emulated/data... for the data that is used to calculate the "validation blob" to activate iMessage. Several of the keys (not values!) are random-looking gibberish like "kbjfrfpoJU" and "oycqAZloTNDm", while others are normal things like "product-name" and "IOPlatformUUID".

It was open sourced by a 16 year old apparently. https://github.com/JJTech0130/pypush They used this and added their own changes. From their communication about what they are doing, it's remarkably similar, and i would be very surprised if they did not see this before.

> With Beeper, you have to give your Apple ID to a third-party app, which they then proxy through a server of some kind (https://techcrunch.com/2023/12/11/beeper-mini-is-back-in-ope... "signing in with our Apple ID generated an Apple prompt that noted our ID was being used to sign in with a device “near Los Angeles, CA” (where we are not located.)") I think they have another primary product of the same name that operates this way, but Beeper Mini never sends your credentials off anywhere other than Apple’s servers [0][1]. [0]: https://blog.beeper.com/p/how-beeper-mini-works [1]: https://github.com/JJTech0130/pypush

In https://news.ycombinator.com/item?id=38531759 its OP states "A team member has published an open source Python iMessage protocol PoC on Github: https://github.com/JJTech0130/pypush."

This should have been obvious to anyone who saw the code where it simply contained the raw literal string `FAIRPLAY_PRIVATE_KEY = b64decode(“…”)`. I suppose now we’ll see how accurate the commenter’s claim “if this becomes a problem, I know how to generate new keys” is. https://github.com/JJTech0130/pypush/blob/main/albert.py#L16

Interestingly, the reference implementation does seem to reference FairPlay, which is very much a copy prevention/anti-circumvention system (used for iTunes content, but also video encryption via HTML EME): https://github.com/JJTech0130/pypush/blob/main/albert.py Assuming that DMCA does not cover API authentication (i.e. preventing unauthorized third-party clients from being able to access a server-side API – and I really don't know if it does or doesn't!), I wonder what the implications are if the same mechanism is used for both DMCA-covered DRM mechanisms, but also non-covered other purposes. My intuition would be that it can't be good to "multi-purpose" a DRM tool from a DMCA enforcement point of view, but maybe that was never Apple's plan, and they just used the most secure attestation technology they had available on each platform, w

Has anyone played with pypush enough ( https://github.com/JJTech0130/pypush ) that I think this is based on to get it easily usable in the same way that signal-cli is? Would be neat to use this for actually cli sending to my one or two friends stuck in Apple land. Thanks!

Depends on whether you consider a private key an "original work": https://github.com/JJTech0130/pypush/blob/main/albert.py#L16 The situation seems very similar to the AACS key leak back in the day: https://en.wikipedia.org/wiki/AACS_encryption_key_controvers...

Unfortunately, there are many typos in my code :P On the other hand, I'm not sure if this is a typo on Apple's part, but it certainly is weird: you must use "WindowSerial" here[1], not "WindowsSerial" with the extra s [1] https://github.com/JJTech0130/pypush/blob/8b33c0ee5d540d8ac7...

The python library they provide should be a good start at least: https://github.com/JJTech0130/pypush

It seems that at least the push notification registration part uses a "leaked/extracted" FairPlay private key [1]. As far as I understand, FairPlay certificates/keys should be unique to each iDevice. Couldn't Apple trivially ban all subscriptions originating from this fake device? The comment says you know how to generate more; does Beeper Mini generate one for each install? Why would Apple believe those certificates are authentic? P.S.: the source repo mentioned in the comment (https://github.com/MiUnlockCode/albertsimlockapple) is 404. [1] https://github.com/JJTech0130/pypush/blob/main/albert.py#L16