Sunbird pauses its efforts to bring iMessage to Android amid security worries

Sunbird, which aims to bring iMessage to Android users, has halted development and pulled its app from the Play Store amid security issues raised this week.

Earlier this week, the company sent a notification to its users, as noted by 9to5Google first, saying that it is pausing the development of the app to investigate security concerns.

“We have temporarily shut down the Sunbird app while we do a detailed security analysis. We will revert back to the community as soon as we are aware of the exact occurrences and our plan to mitigate them going forward,” the company said on its Discord on November 19.

Multiple users on the Sunbird subreddit noted that they had received a notification from the company about the app’s shutdown.

Sunbird sent a notification to users that it is pausing development of its app

Image Credits: Imgur/Reddit (opens in a new window)

“We have been working around the clock on the app to address the concerns that were raised and improve the experience. Navigating the press and our partner obligations kept us from sending a message sooner. Lots going on still and we’re committed to Sunbird’s success,” the company said on its Discord on Tuesday in an update.

Sunbird messaging was founded in 2021 and has received a total of $2.9 million in funding according to Crunchbase data. The company released its app in a closed program last December.

The app came into the limelight when Nothing — a company started by OnePlus co-founder Carl Pei — announced earlier this month that it is using Sunbird’s technology to bring iMessage to Android through Nothing Chats.

However, after the announcement, multiple researchers pointed out security flaws within the app, including messages being sent in plain text, as pointed out in a blog post from Texts.com.

and an amazing deep dive by @ridafkih detailing the atrocious @sunbirdapp / @nothing chats security:https://t.co/Y6ZQxA0N4B

— Kishan Bagaria (@KishanBagaria) November 18, 2023

Other security researchers, including researcher Dylan Roussel, also pointed out that all messages and media sent through Nothing Chats and Sunbird are public.

Thread time!

Summary:
– Sunbird has access to every message sent and received through the app on your device.

– All of the documents (images, videos, audios, pdfs, vCards…) sent through Nothing Chat AND Sunbird are public.

– Nothing Chats is not end-to-end encrypted.

— Dylan Roussel (@evowizz) November 18, 2023

nothing chats app (skinned sunbird) is an absolute privacy nightmare that sends/stores ALL data unencrypted on firebase

and for whatever reason it also sends ALL messages and attachments to sentry (again, in plain text) pic.twitter.com/CxBS7TZwCl

— wukko (@uwukko) November 18, 2023

In response to these claims, Nothing pulled the Nothing Chats beta from the Play Store and said it would work with Sunbird to “fix several bugs.”

We've removed the Nothing Chats beta from the Play Store and will be delaying the launch until further notice to work with Sunbird to fix several bugs.

We apologise for the delay and will do right by our users.

— Nothing (@nothing) November 18, 2023

Given the blue bubble/green bubble divide, many message aggregator apps have tried to solve this problem. The aforementioned Texts.com, which was acquired by WordPress.com owner Automattic last month for $50 million, offers iMessage on Mac and SMS with iMessage. Pebble founder Eric Migicovsky’s Beeper also offers iMessage integration in some capacity. However, there have been questions about the privacy and security impact of these solutions.

All these developments come amid news from Apple last week saying that the company will adopt RCS (Rich Communication Standards) — a superpowered alternative to SMS that allows sending multimedia messages with other features — next year. While this might not solve the green and blue bubble divide, users on Android would be able to send high-res photos and videos to their friends and family using iPhones.