Sunbird has been promising iMessage support on Android for about a year now, but the company has always seemed rather sketchy. Now, as Nothing Chats, built on Sunbird, has launched, the privacy nightmare is coming true – not only is the app not end-to-end encrypted as promised, but image files from other users are pretty easy to access in plain text.
The promise of Sunbird and, in turn, Nothing Chats is to deliver iMessage support to Android. This is done by having users log into their Apple ID through the app which routes the login through a Mac server farm. It’s not a unique method, but the big differentiator here is that Sunbird has made a big deal out of claiming that end-to-end encryption is kept in place throughout the whole process.
On Sunbird’s website it directly says:
The Sunbird servers do not store user data promoting a safe, secure, and private messaging environment. With end-to-end encrypted, confidential messaging, Sunbird is fully secure and completely private.
By adding encryption between Android and iMessage where there currently is none, Sunbird is the first of its kind to give a unified and safe messaging experience to Android users.
Nothing reiterates this on a landing page for Nothing Chats, saying:
…Nothing Chats is built on Sunbird’s platform and all Chats messages are end-to-end encrypted, meaning neither we nor Sunbird can access the messages you’re sending and receiving.
But, that’s just not true.
Frightening new findings reveal that Sunbird and Nothing Chats are, in fact, not fully end-to-end encrypted, as user data can be accessed in plain text.
“Wukko” on Twitter/X published findings that Nothing Chats sends all media attachments, including user images, to Sentry…
read more 9to5google.com
