Global consumer electronics brand Nothing has removed its new Apple’s iMessage-compatible “Nothing Chats” beta app powered by messaging platform Sunbird from the Google Play Store just a day after its release over privacy concerns.
In a post on X on Saturday, the company said it is delaying the launch until further notice.
“We’ve removed the Nothing Chats beta from the Play Store and will be delaying the launch until further notice to work with Sunbird to fix several bugs. We apologise for the delay and will do right by our users,” Nothing said.
The removal came after users shared a blog from Texts.com showing Sunbird’s message encryption isn’t end-to-end — and that it’s easy to compromise, reports The Verge.
According to 9to5Google, Dylan Roussel discovered Sunbird’s solution involves decrypting and transmitting messages using HTTP to a Firebase cloud-syncing server and storing them there in unencrypted plain text.
In his post, Roussel states that Sentry, a service used for debugging, records messages as errors for the company.
“Sunbird has access to every message sent and received through the app. They do this by abusing @getsentry, which is used to monitor errors. But Sunbird logs messages, pretending they are errors,” he wrote.
However, Sunbird claimed that HTTP is “only used as part of the one-off initial request from the app notifying back-end of the upcoming iMessage connection”.
Nothing Chats was announced on November 14, and the beta version was released on November 17.
20231119164257