Nothing Chats, an iMessage app for Android, is a privacy nightmare | Hacker News Reader

Nothing Chats, an iMessage app for Android, is a privacy nightmare

9to5google.com

42 pointsraybb25 comments

> Will the app be open source?

> Some of the messaging community believes that software that is open source is more secure. It is our view that it is not. The more visibility there is into the infrastructure and code, the easier it is to penetrate it. By design, open source software is distributed in nature. There is no central authority to ensure quality and maintenance and by putting that responsibility on Sunbird, development would not be feasible. Open source vulnerabilities typically stem from poorly written code that leave gaps, which attackers can use to carryout malicious activities.

> https://www.sunbirdapp.com

Wow. I can understand not making app open source due to business model but that explanation is something else, mother of all red flags.

> The more visibility there is into the infrastructure and code, the easier it is to penetrate it.

Then they are assuming their whole app infrastructure is written poorly and insecure, then instead of fixing their app they will take the lazy route and make the app closed source.

That’s basically programmer code for “I am an idiot.”

I’ve heard this reason many times over the years and, universally, it’s made by someone who is completely clueless. Many times by a stupid business person, but sometimes by an even stupider engineer.

Even worse is that it shows a stupidity of philosophy over a stupidity of knowledge.

Good write up: https://texts.blog/2023/11/18/sunbird-security/

Worst security practices of all time.

The way I understand it, they’re basically taking Mac minis, logging in to iMessage, and hacking together a message liaison to get your messages through with Apple’s messaging app.

Let’s say I use this service…how confident can I be that Apple doesn’t pull the plug on Nothing?

I think Apple could easily figure out where their traffic is coming from and block it.

> Let’s say I use this service…how confident can I be that Apple doesn’t pull the plug on Nothing?

Technically not at all, practically they would be making arguments for EU why sideloading is needed.

Apple would have a fairly strong argument that this service is placing their users' security at risk, since it's not only giving Nothing full access to their users' text messages but also to everything else attached to their Apple ID account (email, photos, browser history, location, health data, etc).

Especially since it's not only Nothing that has access.

Sideloading wouldn't change this situation at all. This is an Android app.

How could this app possibly be E2EE? They would need to decrypt the message in order to forward it to Apple.

> How could this app possibly be E2EE?

The promise was, implicitly, that Nothing (terrible name) had reimplemented enough of the iMessage encryption architecture to replicate it on an Android phone. If that had been the case, there's no reason they couldn't have made it end-to-end encryption, just like Apple's implementation of iMessage is.

The reality is that they lied. It's not clear that there was any encryption involved beyond standard TLS and (possibly?) at-rest encryption in Firebase. None of this adds up to E2EE.

Apple has taken steps over the past several years to tie the cryptography in iMessage (and APNs generally) to Apple manufactured devices. It’s telling that every legitimate way of bridging onto iMessage to date has required an Apple device.

Tangentially related: My thinking is Apple’s reverse course on RCS will help them justify keeping iMessage itself closer to Apple platforms, particularly when governments/society demand that they justify their closed access.

You’re spot-on with RCS. Apple can point to it and say “we support open standards including everything Android supports.”

>It’s telling that every legitimate way of bridging onto iMessage to date has required an Apple device.

AFAIK you could get imessage to work on a hackintosh, which technically isn't an apple device.

I'm guessing they don't view hackintoshes as legitimate. I'm curious about legitimate businesses that are built around hackintoshes.

The point is that Apple couldn't possibly be requiring some hardware backed signature (i.e. HW attestation that this is a genuine Apple product) for iMessage if Hackintoshes can pull it off. In so far as Hackintoshes can send iMessages without any sketchy middle-end servers, so too could Android devices if someone were able to reverse engineer enough of the stack.

Isn't it like a emulated TPM? It may or may not secure, but it works as a TPM.

Apple does not use TPMs. They use their own proprietary security chips, which approximates TPMs. I'm not sure how their implementation works, but even for TPMs "emulated TPM" won't work because real TPMs have endorsement keys[1] with accompanying certificates signed by the manufacturer. If apple really wanted to, they could check against such key, which would theoretically block non-genuine devices.

[1] https://en.wikipedia.org/wiki/Trusted_Computing#Endorsement_...

For Hackintosh purposes, the security chip doesn't come into play, at least not yet. There are still Macs supported by the latest macOS that don't require a T1 or T2 security chip.

No. The only Apple-specific hardware information that Apple services like iMessage require is a couple of hardware serial numbers; Hackintosh systems just make one up.

https://dortania.github.io/OpenCore-Post-Install/universal/i...

They just passed messages through Macs.

That's so bad it's almost as bad as discord.

can someone explain to me how this is any different from beeper?

It’s no different. But Beeper at least makes that clear, including this warning call out, with caution signs, in the FAQ:

> Using native chat apps independently may be more secure than connecting to other encrypted chat networks with Beeper.

Reply on news.ycombinator.com