https://www.theverge.com/2023/11/18/23966781/nothing-chats-imessage-unencrypted-sunbird-plaintext

Skip to main content
 The Verge logo.The Verge homepage

  * The Verge homepageThe Verge logo./
  * Tech/
  * Reviews/
  * Science/
  * Entertainment/
  * MoreMenu

 The Verge logo.
Menu

  * Tech/
  * Security/
  * Android

Nothing Chats has already been pulled from Google Play over privacy
issues

Nothing Chats has already been pulled from Google Play over privacy
issues

/

Nothing pulled the Nothing Chats beta from the Google Play store
"until further notice" after reports that Sunbird sends messages in
plain text.

By Wes Davis, a weekend editor who covers the latest in tech and
entertainment. He has written news, reviews, and more as a tech
journalist since 2020.

Nov 18, 2023, 6:09 PM UTC|

Share this story

  * 
  * 
  * 

If you buy something from a Verge link, Vox Media may earn a
commission. See our ethics statement.

A person holding an Android phone and using Nothing Chats.
Nothing Chats shown in a promotional image. Image: Nothing

Nothing has pulled the Nothing Chats beta from the Google Play store,
saying it is "delaying the launch until further notice" while it
fixes "several bugs." The app promised to let Nothing Phone 2 users
text with iMessage, but it required allowing Sunbird, who provides
the platform, log into users' iCloud accounts on its own Mac Mini
servers, which... isn't great?

The removal came after users widely shared a blog from Texts.com
showing that messages sent with Sunbird's system aren't actually
end-to-end encrypted -- and that it's not hard to compromise it. The
app launched in beta yesterday after being announced earlier this
week.

9to5Google pointed to a thread from site author Dylan Roussel, who
found that part of Sunbird's solution involves decrypting and
transmitting messages using HTTP to a Firebase cloud-syncing server
and storing them there in unencrypted plain text. Roussel posted that
the company itself has access to messages because it logs them as
errors using Sentry, a debugging service.

Sunbird claimed yesterday that HTTP is "only used as part of the
one-off initial request from the app notifying back-end of the
upcoming iMessage connection."

That was in response to someone pointing to Texts.com's blog
examining the vulnerability. Texts.com wrote that "an attacker
subscribed to the Firebase realtime database will always be able to
access the messages before or at the moment they are read by the
user." The blog also points out that the company could look at
messages in its Sentry dashboard, directly contradicting the claim
from Nothing's FAQ that nobody at Sunbird can access messages that
are sent or received.

We've reached out to Nothing for further comment, but the company did
not respond by press time.

Most Popular

 1. Sam Altman fired as CEO of OpenAI

    -----------------------------------------------------------------
 2. Windows is now an app for iPhones, iPads, Macs, and PCs

    -----------------------------------------------------------------
 3. Screens are good, actually

    -----------------------------------------------------------------
 4. Apple pulls its ads from X after Musk's antisemitic posts

    -----------------------------------------------------------------
 5. What happened to Sam Altman?

    -----------------------------------------------------------------

Verge Deals

/ Sign up for Verge Deals to get deals on products we've tested sent
to your inbox daily.

Email (required)[                    ]Sign up
By submitting your email, you agree to our Terms and Privacy Notice.
This site is protected by reCAPTCHA and the Google Privacy Policy and
Terms of Service apply.
From our sponsor

 

 
Advertiser Content FromSponsor logo
Sponsor thumbnail

More from Tech

  * The back of the Pixel 8 Pro is matte glass that comes in a new
    light blue color.The back of the Pixel 8 Pro is matte glass that
    comes in a new light blue color.

    Do Pixel 8 AI-edited photos have to be labeled as synthetic
    content on YouTube? YouTube is still figuring it out.

  * An image showing the SAG-AFTRA logo on a pink and blue background
    An image showing the SAG-AFTRA logo on a pink and blue background

    SAG-AFTRA's new contract hinges on studios acting responsibly
    with AI

  * A shot of Starship launchingA shot of Starship launching

    SpaceX's second Starship flight test ends in an explosion minutes
    after launch

  * Sam Altman.Sam Altman.

    What happened to Sam Altman?

  * 
     
    Advertiser Content FromSponsor logo

     

 The Verge logo.

  * Terms of Use
  * Privacy Notice
  * Cookie Policy
  * Do Not Sell Or Share My Personal Info
  * Licensing FAQ
  * Accessibility
  * Platform Status
  * How We Rate and Review Products

  * Contact
  * Tip Us
  * Community Guidelines
  * About
  * Ethics Statement

The Verge is a vox media network

  * Advertise with us
  * Jobs @ Vox Media

(c) 2023 Vox Media, LLC. All Rights Reserved