Nothing's iMessage App For Android Is A Privacy Nightmare, Gets Yanked From Play Store
![nothing imessage security hero1](https://images.hothardware.com/contentimages/newsitem/63137/content/nothing-imessage-security-hero1.jpg)
Unfortunately, Nothing and its partner Sunbird appear to have cut a few corners. Text.com’s reverse engineering team published a blog post with a complete rundown of the app’s security and privacy failings, after the team noticed conflicting statements following the messaging app’s official announcement.
An attacker can access all of a user’s details because of a data in transfer vulnerability, brought about because Sunbird uses a server which does not implement SSL. There’s also a data in rest vulnerability because Sunbird saves data in an unencrypted server. Lastly, there is a possibility that someone working at Sunbird can access user data because all messages are routed through the Sunbird Sentry debugging platform.
![nothing imessage security body1](https://images.hothardware.com/contentimages/newsitem/63137/content/nothing-imessage-security-body1.jpg)
Sunbird’s response to this situation has been less than ideal. When presented with the information found by the reverse engineering team, Sunbird felt the need to deny any of the findings and insists that Nothing Chats, along with all of its other services, are completely secure. It’s disappointing to see this response considering the nature of the data they are entrusted with.
Thankfully, there are security pros who take the time to investigate situations such as this one. Time will tell how damaging this saga will be for Nothing.