Nothing Chats

~ the goodbye ~

The green bubble problem is american. In turkey everybody has been on WhatsApp for well over a decade, and the question of what color your message arrives in has never once come up, because it arrives in the same app for everybody. Nothing Chats existed to solve a status anxiety I have never had, which is worth saying up front, because that anxiety is the entire reason the product got built and funded.

Nothing is Carl Pei's phone company, started after he left OnePlus, and its whole pitch is design confidence on Android. On 14 november 2023 it announced Nothing Chats, an app for the Nothing Phone (2) that would let an Android user turn up in iMessage as a blue bubble. The plumbing came from a company called Sunbird, which had been promising the same trick for a while and had a track record people had already looked at.

The way this works, when it works, is that your Apple credentials go to a Mac sitting in somebody's rack, that Mac logs into iMessage as you, and the messages get relayed back to your handset. It is a real architecture and there was already an open source project doing it called BlueBubbles. The question everybody asked before launch was what happens to your Apple ID and your message contents while they are on that server. Nothing and Sunbird said the answer was end to end encryption.

Ars Technica and Android Authority both published warnings before the app shipped. Ars specifically told readers not to hand Apple credentials to a third party that might not understand the risk it was taking on. They were right, and it took less than twenty four hours for everyone to find out how right.

~ the chronicle ~

~ the funny part ~

On 17 november, the day the beta went live, a developer pulled the app apart and found it was running a version of BlueBubbles, the open source project it was nominally competing with. That was embarrassing rather than dangerous. What sat next to it was dangerous: Sunbird had never obtained a TLS certificate, so the app was sending users' service credentials over plain HTTP, where anybody on the same network could take them and impersonate the account.

The next day it got worse. Another researcher found the app shipping every media attachment to Sentry, an error logging service, with the links in plaintext, and mirroring everything into a Firebase instance where none of it was encrypted. That database held more than 630,000 media files. 9to5Google confirmed the Firebase credentials could be lifted off any handset and used to read other people's messages in real time, and somebody wrote a script to download the lot and published it on GitHub.

Nothing removed the app from Google Play within twenty four hours and posted a statement about delaying the launch until further notice while it worked with Sunbird to fix several bugs. Describing an open database of six hundred thousand strangers' photographs as several bugs is the sentence that did the most lasting damage to the company.

~ the postmortem ~

Sunbird paused its own service on 21 november and told users to change their Apple ID passwords and delete the app. Sunbird itself came back with a fresh beta in april 2024 and its website still resolves today. Nothing Chats did not come back. Its page on nothing.tech returns a 404 and no relaunch was ever announced, so the delay until further notice quietly became the shutdown notice.

The category around it collapsed within a month for unrelated reasons. Apple had already announced RCS support for the iPhone on 16 november 2023, two days after Nothing announced Chats and one day before it shipped, which meant the blue bubble gap was going to close on Apple's own schedule. Beeper Mini launched on 5 december with an approach that never asked for your Apple ID, and Apple broke it inside three days and kept breaking it. Nothing Chats was the worst attempt at the problem, and it was also close to the last one anybody made in that particular shape.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »