Nothing has revealed its latest project, Nothing Chats, an app intended to make iMessage accessible to Android users. But behind this attractive promise, the application has major security problems.
November 19 update:
Nothing has removed the Nothing Chats beta from the Google Play Store “until further notice” after reports that Sunbird is sending unencrypted messages.
Original article from November 17:
Nothing has just announced its latest app: “Nothing Chats”. This app aims to bridge a long-standing gap in communication between Android and iPhone users, by making messages sent to an iPhone compatible with iMessage.
Nothing Chats is available for free, but it has a notable exclusivity: it is only accessible on the Nothing Phone (2).
8 /10
A major security concern confirmed
The application has been released online (APK). As expected, to use Nothing Chats, users are required to enter their Apple IDs into a system managed remotely by Sunbird, specifically using a Mac mini located on a server farm. It is through this intermediary that the application promises access to iMessage features on an Android smartphone.
However, since the launch of Nothing Chats, users have identified major security issues. This is because communications involving sending Apple ID data are done without proper encryption, using the HTTP protocol rather than a secure method.
Although Sunbird and Nothing claim that the data is end-to-end encrypted, this claim seems at odds with current technical observations. It is therefore strongly discouraged to use this application, given the potential risks to user security and privacy.
At the same time, Apple announced its intention to support the RCS standard in 2024. This initiative, although late, is a step towards better interoperability between operating systems. RCS will allow Android users to benefit from some features previously exclusive to iPhone users, such as enhanced group chats.