(Photo by Jaap Arriens/NurPhoto via Getty Images)
An app designed to bring Apple’s iMessage to Android has temporarily shut down after it was found exposing user information, including personal chats.
Sunbird grabbed headlines last week after the Android smartphone startup Nothing announced it would use the technology for its own handsets. Nothing hyped up the chat system as a way to get around iMessage’s exclusivity on iOS. There was just one problem: the messaging on Sunbird wasn’t secure.
Nothing has since removed the beta version of its chat app to fix the issue. Now Sunbird itself has hit pause on offering its own messaging app to users. On Saturday, Sunbird users received alerts about the app stoppage.
(Credit: Reddit user nascarrocks)On Discord, Sunbird also said: “We have temporarily shut down the Sunbird app while we do a detailed security analysis. We will revert back to the community as soon as we are aware of the exact occurrences and our plan to mitigate them going forward."
The company has been offering Sunbird behind a waitlist. So only early access users will be affected. Still, the privacy gaffe isn’t a good look for a messaging app that promises users complete end-to-end encryption. To offer iMessage on Android, Sunbird essentially used a cluster of Mac computers with access to Apple’s chat system.
Hence, a Sunbird user is essentially using the cluster of Macs to create their own iMessage accounts and then relay the messages back to their Android phone. The approach naturally raised privacy red flags because it means Sunbird functions as a middle man that can technically peek at every user's iMessage account, although the company claims it can't do so. "This means that the company does not store any user data on its servers, nor does it collect any metadata about messages," Sunbird wrote in a FAQ.
Then last week, Twitter users investigated Nothing’s implementation of Sunbird and found it was sending unencrypted user information to Firebase and Sentry, two mobile app development platforms. In addition, 9to5Google discovered a user can also access the “Firebase database and see messages and files from other users sent in real-time and in plain text.”
On Tuesday, Sunbird remained down with the company stating: “We have been working around the clock on the app to address the concerns that were raised and improve the experience. Navigating the press and our partner obligations kept us from sending a message sooner. Lots going on still and we're committed to Sunbird's success.”