10:48 AM EST | Update: Nothing has confirmed they have removed the app from the Google Play store.
We've removed the Nothing Chats beta from the Play Store and will be delaying the launch until further notice to work with Sunbird to fix several bugs.
We apologise for the delay and will do right by our users.
— Nothing (@nothing) November 18, 2023
Advertisements 9to5Google has published an incredibly technical and detailed report today that has raised several security concerns about the Nothing Chats app, released yesterday.
Nothing Chats enables the sending and receiving of Apple Messages on Nothing’s Phone (2) devices and was built in partnership with Sunbird, a U.S. technology company that specializes in Android and web messaging.
Image: Nothing Chats Advertisements Prior to the app’s release, Nothing explained that from a security perspective, all Chats messages are end-to-end encrypted, meaning neither Nothing nor Sunbird can access any of the messages you send and receive.
Nothing further set out that no messages or Apple ID credentials are stored on their servers, saying, “No, Nothing is powered by Sunbird, and Sunbird’s architecture provides a system to deliver a message from one user to another without ever storing it at any point in its journey. Messages are not stored on Sunbird’s servers and are only live on your device – once a message is delivered, it can only be recovered locally from your personal device.”
On X—formerly Twitter—user @uwukko, also known as wukko, posted their breakdown and findings after examining Nothing Chats post-release.
nothing chats app (skinned sunbird) is an absolute privacy nightmare that sends/stores ALL data unencrypted on firebase
and for whatever reason it also sends ALL messages and attachments to sentry (again, in plain text) pic.twitter.com/CxBS7TZwCl
— wukko (@uwukko) November 18, 2023
Advertisements wukko noted that the app “sends/stores ALL data unencrypted on firebase” and “for whatever reason it also sends ALL messages and attachments to sentry (again, in plain text).”
9to5Google independently confirmed wukko’s findings via Dylan Roussel, who also posted their findings on X.
Thread time!
Summary:
– Sunbird has access to every message sent and received through the app on your device.
– All of the documents (images, videos, audios, pdfs, vCards…) sent through Nothing Chat AND Sunbird are public.
– Nothing Chats is not end-to-end encrypted.
— Dylan Roussel (@evowizz) November 18, 2023
Texts.com—also a cross-platform messaging service that was recently acquired by WordPress.com’s parent company, Automattic—posted their analysis, results, and concerns on both their blog and on X.
texts team took a quick look at the tech behind nothing chats and found out it's extremely insecure
it's not even using HTTPS, credentials are sent over plaintext HTTP
backend is running an instance of BlueBubbles, which doesn't support end-to-end encryption yet pic.twitter.com/IcWyIbKE86
— Kishan Bagaria (@KishanBagaria) November 17, 2023
Advertisements Sunbird replied to Texts.com’s concerns, reiterating their belief that, “All sensitive user data such as Apple ID credentials and messages are encrypted at all times.”
Screenshots from Texts.blogTexts.com countered, hypothesizing that Sunbird has “a misunderstanding of the functionality of the technologies they’re leveraging.”
Advertisements 9to5Google notified Nothing about their concerns, and while at press time, there has not yet been a formal response, the Nothing Chats app is currently not showing as available on the Google Play store in Canada.
Overall, this seems pretty damning and concerning. We’ll continue to monitor developments and update as needed.
https://cantechnews.ca/2023/11/18/nothing-chats-appears-to-be-a-privacy-nightmare/
#TextsCom #Nothing #Security
eicker.TV ▹ Tech News
techi
Jan Sobotka
Brad Linder
CanTechNews.ca