SLTechnology News&Howtos › IT Information ›

Analysts say Nothing's chat App, which focuses on "iMessage interworking between Android and Apple", has no end-to-end encryption function.

Shulou Source: shulou.com Published: 2023-11-24 22:07:23 10月02日 Update

Thanks to CTOnews.com netizen OC_Formula for the clue delivery! CTOnews.com, Nov. 18 (Xinhua)-- Nothing announced on November 15 the launch of an Android app called Nothing Chat, which allows users to chat with Apple iMessage users.

However, in the early hours of this morning Beijing time, Kishan Bagaria, founder of the integrated information application Texts, wrote on the X platform that his team took a quick look at the code behind Nothing Chat and found that it was not secure. It says, "it doesn't even use HTTPS, but sends credentials through plaintext HTTP."

According to the analysis of foreign media Appleinsider, the main problem of Nothing Chat is that there is no HTTPS (Hypertext transfer Security Protocol) in its communication protocol, and it is the basic security standard of current Internet communication, which can encrypt the data between user equipment and server.

In the absence of such encryption, it means that sensitive information, including login credentials, will be passed on the Internet through plaintext HTTP.

The results also show that Nothing Chats uses a backend provided by BlueBubbles, but it is a messaging company known for its "lack of end-to-end encryption".

After that, however, Sunbird (CTOnews.com Note: an unofficial iMessage client), which supports Nothing Chat, told Kisian Bagaria that they did not use the "BlueBubbles" mentioned above, just a coincidence in naming.

"We can't confirm what they used internally, but all text messages / media received are not only unencrypted, but all text messages sent are leaked to the Sentinel server in clear text," Kisian Bagaria said later.

According to CTOnews.com, Carl Pei, CEO of Nothing, said the app will support functions such as single chat, group chat, audio and video file sharing, voice, and real-time display of user input. Functions such as "message response" and "reply" will also be added in the future.