The beta version of the Nothing Chats app has been removed from the Google Play store, with Nothing stating it is “delaying the launch until further notice” to address multiple bugs. The app, designed to enable Nothing Phone 2 users to text with iMessage, raised security concerns as it required users to grant Sunbird, the platform provider, access to their iCloud accounts on its Mac Mini servers.
The removal followed the widespread sharing of a blog post from Texts.com, revealing that messages sent through Sunbird’s system lacked end-to-end encryption and the system’s security could be compromised easily. The Nothing Chats app’s beta version had been launched recently after being announced earlier in the week.
The investigative work by 9to5Google highlighted a thread by Texts.com’s Dylan Roussel, who discovered Sunbird’s solution involved decrypting and transmitting messages via HTTP to a Firebase cloud-syncing server. Messages were stored on the server in an unencrypted plain text format. Roussel found Sunbird had access to messages, logging them as errors using Sentry, a debugging service.
Sunbird responded that HTTP was “only used as part of the one-off initial request from the app notifying back-end of the upcoming iMessage connection.” This statement replied to concerns raised in Texts.com’s blog about the vulnerability. Texts.com pointed out that “an attacker subscribed to the Firebase real-time database will always be able to access the messages before or at the moment they are read by the user.” The blog contradicted Nothing Chats’ FAQ claim that no one at Sunbird could access the messages sent or received.
The security flaws and potential access to user messages have prompted Nothing to take swift action, removing the Nothing Chats app’s beta version to address the identified bugs and security issues. As the situation unfolds, users and the tech community are closely monitoring developments, and Nothing is expected to provide further updates on resolving the security concerns before the app’s official launch.
