Earlier this week, Nothing did the unexpected and launched the “Nothing Chats” app for the Nothing Phone 2. The premise? Let anyone with a Nothing Phone 2 send and receive texts via iMessage. Nothing partnered with Sunbird to make Nothing Chats work, with Nothing essentially using Sunbird’s own messaging tech to bring iMessage to Android.
It was a bold idea … but one that was short-lived. That’s because Nothing Chats is already dead (for the time being) due to a shocking number of security vulnerabilities that were discovered almost immediately. And by security vulnerabilities, we don’t mean minor oversights that could have been easy to overlook. We’re talking about major, game-breaking design flaws that massively compromise the personal information of anyone who used Nothing Chats.
Nothing Chats launched in beta access on November 17, and within hours of people getting their hands on the app, worrying security concerns started popping up. One of the first reports came from Kishan Bagaria, the founder of Texts.com. Bagaria and their team discovered that messages sent via Nothing Chats weren’t using HTTPS security credentials. Instead, messages were being sent on the much less secure HTTP standard in plain text.
texts team took a quick look at the tech behind nothing chats and found out it's extremely insecure
it's not even using HTTPS, credentials are sent over plaintext HTTP
backend is running an instance of BlueBubbles, which doesn't support end-to-end encryption yet pic.twitter.com/IcWyIbKE86
— Kishan Bagaria (@KishanBagaria) November 17, 2023
But it wasn’t just Bagaria who discovered these vulnerabilities. Wukko on X (formerly Twitter) also confirmed that anything sent via Nothing Chats — including standard text messages, images, and other media attachments — was done using plain text and clearly visible to anyone who knew where to look.
Furthermore, and even more troubling, Wukko found that all messaging data sent by and stored in Nothing Chats was done unencrypted and via an easily accessible Firebase platform.
nothing chats app (skinned sunbird) is an absolute privacy nightmare that sends/stores ALL data unencrypted on firebase
and for whatever reason it also sends ALL messages and attachments to sentry (again, in plain text) pic.twitter.com/CxBS7TZwCl
— wukko (@uwukko) November 18, 2023
These reports were bad enough, but additional reporting from 9to5Google further reiterated just how serious these vulnerabilities really were. Per 9to5’s own findings:
“In our Dylan Roussel’s research, we found that once a user authenticates with the JSON Web Tokens (JWT) that are insecure in transit, they can access Nothing Chat’s Firebase database and see messages and files from other users sent in real-time and in plain text.”
The report goes on to mention how vCards (aka contact cards) were also fully accessible — including people’s names, numbers, email addresses, and other personally identifiable information. And as if that wasn’t enough, 9to5Google also discovered more than 630,000 media files stored in Sunbird’s Firebase server — the company that powers the Nothing Chats app.
In summary, this is what we’re looking at:
In other words, this is all very, very bad. It’s especially worse considering how quick Nothing was to rebuke these initial security concerns, further claiming that messages were end-to-end encrypted when — in reality — they absolutely were not.
On November 18, just one day after launching Nothing Chats, Nothing announced on X that it was officially removing the Nothing Chats app from the Play Store and “delaying the launch until further notice” so the company could “work with Sunbird to fix several bugs.”
Pulling the app and delaying the launch is the right call on Nothing’s end, but it’s impossible to overstate how much damage has likely already been done by this whole debacle.
We've removed the Nothing Chats beta from the Play Store and will be delaying the launch until further notice to work with Sunbird to fix several bugs.
We apologise for the delay and will do right by our users.
— Nothing (@nothing) November 18, 2023
At the end of the day, these security issues are Sunbird’s fault. Nothing Chats was built on Sunbird’s backend, and it’s up to Sunbird to address these concerns. However, Nothing still decided to partner with Sunbird to create and launch Nothing Chats, and the fact that the company never discovered these vulnerabilities while creating Nothing Chats is troubling.
If you still have the Nothing Chats app on your phone, we strongly advise you to stop using it immediately. That same recommendation applies if you’re using the regular Sunbird app as well. Having iMessage on an Android phone is a fun convenience, but not at the risk of your personal information being so heavily compromised. You’re better off just waiting for Apple to add RCS to the iPhone in 2024.
As for the future of Nothing Chats, it’s difficult to say what will happen next. Nothing says it’s “delaying” the launch, but to fix all of the issues we just talked about here, Sunbird would have to dramatically overhaul its entire backend process. Is Nothing going to want to wait for that to happen, or will it decide to just cut its losses and pull the plug on Nothing Chats for good? At this point, it seems like the latter may be the better choice.
Motorola has built some of my favorite foldables and flagship phones. I had a great time with both the Razr Fold and last year's Signature. So when the company began teasing the Signature 27, I couldn't help be excited. The new model comes with Qualcomm's blazing-fast Snapdragon 8 Elite Extreme Gen 6, and better still, it is finally getting a proper global release.
One of the reasons I was obsessed with the last-gen Signature was its amazing price tag. But it seems like that budget flagship dream might be officially dead. Portuguese retailer MegaPC has prematurely listed a 12GB RAM and 512GB storage Signature 27 in Pantone Coal Smoke for €1,594.90 (approx. $1,775).
Two new highly requested iCloud plugins just got added to ChatGPT, giving people who rely on Apple’s Mail and Calendar services a way to search emails, check appointments, and manage their schedules directly through the chatbot.
The integration is rolling out to all ChatGPT plans, including the free tier. You can access it on the web, desktop, and iOS.
Google Play is borrowing one of the Nintendo Switch’s most useful little tricks. A new Sidekick tool called Playbacks captures a short clip after something interesting has already happened, sparing players from running a screen recorder throughout an entire game.
Playbacks is part of Google Play Store v53.8 and keeps saved clips on the phone. Google first announced it earlier this month, but the new Play Store update marks its arrival for players. Anyone who has watched a perfect win vanish because the record button came too late already understands the appeal.