Sunbird returns after iMessage Android security nightmare

It’s clear that iMessage for Android is no easy task, but one of the apps that attempted to do just that (before it turned out to be a terrible security nightmare), Sunbird, is taking on a new challenge. I am.

Sunbird confirmed in a press release that it plans to restart its iMessage service for Android starting today.

Sunbird first appeared in 2022 and promised to bring iMessage to Android. The app was released as a private beta with a waiting list, but was never made available to many users. In fact, the service didn’t become widely available until Nothing partnered with Sunbird to launch “Nothing Chats.”

Within days of the release of Nothing Chats powered by Sunbird, we reported a major security issue with the app. This included, among other things, user-shared media and messages that were relatively easily accessible. It will be displayed in the same way as it was sent in real time. That was bad.

Days after the incident, Sunbird announced it would cease operations indefinitely.

Well, somehow Sunbird is back.

Sunbird says invitations to those on the waiting list will begin “gradually” starting today, April 5.

In a press release, Sunbird noted that Apple had blocked “unauthorized access” to iMessage by Beeper, saying it “serves as a bridge between Android and Apple users, enabling secure communication within the Apple ecosystem. ” promoting the platform.

The press release itself doesn’t explain what Sunbird has changed, other than promising to “deliver a robust, secure, and unified messaging experience.”

In a further post on its website, Sunbird actually mentioned security issues with its “unencrypted HTTP protocol” and said that following several discoveries along with a number of security issues, it has decided to update its infrastructure. He also denies using “BlueBubblesApp” as part of the . Sunbird said it took time to “thoroughly re-evaluate both our technical implementation and organizational processes” following last year’s debacle.

So, has anything changed?

Sunbird says that the “old architecture” that used Firestore (part of Firebase) has been replaced. The new AV2 architecture uses “the OASIS standard MQTTS message broker for secure messaging,” Sunbird said. Also, like Nothing Chats, the app will integrate with RCS via Google Messages.

The company further claims:

• Unencrypted messages are not stored anywhere on disk or in the database. When a message is decrypted and passed to iMessage and the RCS/Google Messages network, it remains in memory for only a limited period of time. In front-end apps, messages are only stored encrypted within the in-app database.
• Static files sent through the Service are stored in secure cloud storage buckets that are encrypted both in transit and at rest. These are protected by permissioned URLs to prevent unauthorized access and are permanently deleted from Sunbird systems within 48 hours of being sent or received.
• All communication from Sunbird apps to the Sunbird API is secured at the transport layer through HTTPS or MQTTS protocols.
• MQTTS brokers are protected by strict access control lists that ensure that users can only access the broker topics assigned to them and no other topics.
• Additionally, the content of the message payload itself is fully controlled by the client and is encrypted at the application layer using AES encryption with an encryption key held only in memory on the Sunbird side. Messages pass through the Sunbird system in an encrypted state and are decrypted (in memory) only upon transfer of the message to the native messaging platform.

Sunbird also added that it has made organizational changes that include CIPHER, an “independent security consultancy,” and Jared Jordan, former director of engineering for Gmail at Google and now an “official advisor” to Sunbird. (Posted by Sunbird) Jordan claims to currently work at Google, but his LinkedIn profile linked to by Sunbird says he left Google in March and is now working at CapitalOne. ing).

9to5Google’s opinion

I myself am shocked that Sunbird is actually making a comeback. After the horrible problems discovered last year, I was convinced this company would never recover (and I’m still not convinced they can earn anyone’s trust).

While it’s great to see Sunbird focusing on problem solving, I’m still pretty wary. As mentioned above, a big red flag is that the company’s new advisor claims to be working for Google when he actually left the position (after just six months) earlier this week. is.

I’m not going to get on Sunbird’s waiting list, but I hope the company really fixes the problem.

More information about iMessage for Android:

Follow Ben: Twitter/Xthreads, instagram