Nothing has pulled the Nothing Chats beta<\/a> from the Google Play store, saying it is \u201cdelaying the launch until further notice\u201d while it fixes \u201cseveral bugs.\u201d The app promised to let Nothing Phone 2 users text with iMessage<\/a>, but it required allowing Sunbird, who provides the platform, log into users\u2019 iCloud accounts on its own Mac Mini servers, which… isn\u2019t great?<\/p>\n<\/div>\n The removal came after users widely shared a blog from Texts.com<\/a> showing that messages sent with Sunbird\u2019s system aren\u2019t actually end-to-end encrypted \u2014 and that it\u2019s not hard to compromise it. The app launched in beta yesterday after being announced earlier this week<\/a>.<\/p>\n<\/div>\n 9to5Google <\/em>pointed<\/a> to a thread from site author Dylan Roussel<\/a>, who found that part of Sunbird\u2019s solution involves decrypting and transmitting messages using HTTP to a Firebase cloud-syncing server and storing them there in unencrypted plain text. Roussel posted that<\/a> the company itself has access to messages because it logs them as errors using Sentry, a debugging service.<\/p>\n<\/div>\n Sunbird claimed yesterday<\/a> that HTTP is \u201conly used as part of the one-off initial request from the app notifying back-end of the upcoming iMessage connection.\u201d <\/p>\n<\/div>\n That was in response to someone pointing to Texts.com\u2019s blog<\/a> examining the vulnerability. Texts.com wrote that \u201can attacker subscribed to the Firebase realtime database will always be able to access the messages before or at the moment they are read by the user.\u201d The blog also points out that the company could look at messages in its Sentry dashboard, directly contradicting the claim from Nothing\u2019s FAQ<\/a> that nobody at Sunbird can access messages that are sent or received.<\/p>\n<\/div>\n We\u2019ve reached out to Nothing for further comment, but the company did not respond by press time.<\/p>\n<\/div>\n<\/div>\n