Nothing Chats found to be unsecure, launch gets delayed indefinitely

Sunbird, the platform in which Nothing Chats is built upon, is apparently not end-to-end encrypted as promised.

Nothing Chats Kv Fi

Nothing unveiled the app just last week, which aims to bring iMessage compatibility to Android.

The process involves users logging into their Apple ID, which then routes the login to random Mac minis as relay points. This enables virtually sending and receive iMessage content between iOS and Android.

texts team took a quick look at the tech behind nothing chats and found out it’s extremely insecure

it’s not even using HTTPS, credentials are sent over plaintext HTTP

backend is running an instance of BlueBubbles, which doesn’t support end-to-end encryption yet pic.twitter.com/IcWyIbKE86

— Kishan Bagaria (@KishanBagaria) November 17, 2023

Dylan Roussel took to X that Sunbird has access to every message through the app on the device—due to it being unencrypted—whereas all the media and document files are publicly accessible in plain text and in real -time.

He mentioned that over 637,780 media and documents are stored by Sunbird, despite the company’s promise that their servers do not store user data.

Roussel particularly pointed out accessible vCards that contain personal information such as users’ names, phone numbers, and email among other personal data.

As a proof, he even downloaded one and was able to access a certain user’s personal info. He says that over 2,300 users’ data are publicly exposed.

Nothing apparently pulled out the app from Play Store, but not as a direct response to the findings. On X, the company announced that they have removed the Nothing Chats beta from Play Store to “fix several bugs”—delaying launch until further notice.

Many users in the thread disagree as the company seemed to be downplaying the situation of a ‘huge’ privacy issue to mere bugs in the app.

Nothing intended to commence the Nothing Chats beta exclusively for Phone (2) users since November 17. However, with Apple, just days after the date, has announced that they will finally support RCS on the iPhone.

This makes this whole premise of bringing iMessage to iPhone trivial, to say the least.

Why was the launch of Nothing Chats delayed indefinitely?

The delay stems from Sunbird, the underlying platform, lacking end‑to‑end encryption and transmitting credentials over unencrypted HTTP.

How does Nothing Chats enable iMessage on Android devices?

The app logs users into their Apple ID and routes messages through random Mac minis acting as relay points to exchange iMessage content.

What security concerns were identified in the Nothing Chats service?

The service transmits data without HTTPS, stores media and documents in plain text, and allows Sunbird to access all messages and personal vCard information.

React to this article: