Apple’s iMessage is making headlines again, as the blue/green bubble debate takes another twist. But these headlines come with a serious new warning for the billion of you with iMessage on your iPhones and for all the Android users you know…
As excitement builds ahead of Apple’s WWDC in June, with firmer detail on iOS 18 due for release in the fall, one thing that seems fairly certain is the significant change to iMessage. But as I’ve reported before, the adoption of RCS alongside iMessage is not the fix that many want it to be. The green bubble problem is not going away.
We’ve just had a stark remind of exactly that, with the latest bridge from Apple’s to Google’s walled gardens. This isn’t the first time we’ve seen Sunbird propose itself as the solution. Last time it disappeared under a very dark security cloud. But now, as Android Central succinctly puts it, “the privacy disaster Sunbird is coming back.”
Sunbird operates as a relay between Android devices and Apple’s ecosystem, essentially converting Android-oriented texts into iMessages when received by Apple devices, and vice versa. As such, those texts appear as blue bubbles.
Because of the relay system, Apple sees these texts as end-to-end encrypted iMessages. But they’re not. Because the relay machine belongs to Sunbird and not the end user. Sunbird says the relay is in memory only, and no messages or credentials are stored on their servers. But they have control over the data and the technical ability to change how it’s handled, which defeats the assurance of end-to-end encryption.
App-wise, Sunbird is just an Android platform. Users don’t need any Apple devices or accounts of their own—Sunbird handles that side. In essence it’s literally a bridge, with the Android user interfacing to Sunbird, and Sunbird into Apple’s ecosystem.
An iMessage user seeing those blue bubbles will believe the conversation is end-to-end encrypted. But it isn’t. The actual endpoint is outside that encryption. This is exactly what WhatsApp meant when it warned that to properly assure end-to-end encryption, a platform needs control of both endpoints as well as transmission.
Sunbird says it “enables secure communication within Apple’s ecosystem,” which is true. But the Android user is physically outside that ecosystem. Because delivering blue bubbles from Android devices is this convoluted, is the very reason you should stop sending texts outside iMessage until there’s a proper solution to end-to-end encryption cross-platform—if that ever happens.
Sunbird’s return is aptly timed for Easter, and comes by way of a formal press release and a website refresh. The release is part mea culpa for what went wrong in 2022 and a promise of a bright and much improved future. Of note given iOS 18, the refresh is built around RCS rather than a homegrown architecture.
“Following reports of security vulnerabilities in the Sunbird platform last November,” Sunbird’s developers said in an expanded release on April 5, “we’re taking this opportunity to update you on our findings, the current status, and our approach to remediating these issues in the upcoming relaunch of the Sunbird app.”
There’s no app to download and install from Play Store or anywhere else at this stage—there’s a waitlist which gives access to a limited beta. So this will unfold slowly.
There’s an explanation from Sunbird of why the new architecture is better than the first, but there’s also a tacit admission that the platform isn’t even trying to deliver the kind of quasi end-to-end encryption Beeper Mini tried for last year. Interestingly, Sunbird actually suggests its lack of end-to-end encryption is a security plus:
“Apple’s decision in December,” Sunbird suggests, “to shut down a different unified messaging app brought to light security and privacy concerns stemming from their unauthorized access to iMessage.” You’ll recall the game of cat and mouse that Apple and Beeper played, as backdoor after backdoor was slammed shut. Beeper’s intent was to insert itself into Apple’s ecosystem, to piggyback on its encryption. Apple deemed that a security risk and the latest Beeper iteration doesn’t even try.
“The app shut down by Apple,” Sunbird says, “was reverse engineering the iMessage protocol to disguise itself as a genuine iMessage client, a method that significantly differs from Sunbird’s approach. Instead, Sunbird’s platform provides a bridge between Android and Apple users, enabling secure communication within Apple’s ecosystem.” Whatever that security solution is, it’s not end-to-end encryption.
Sunbird’s security holes, as now laid out, go to show why messing around with sub-scale messaging platforms is a risky venture. Messages in transit were not fully secure and could potentially be open to unauthorized access, and users could potentially be spoofed, albeit Sunbird says credentials remained secure. Now it has decided to rearchitect ground-up, using a more traditional solution built on RCS.
But the issue for Sunbird becomes a why, rather than a what. The whole point of iMessage is its level of security, now replicated by Google Messages. Pull people out of that protection and you might as well wait for Apple’s RCS deployment with iOS 18 in the fall. That will essentially do the same, albeit backed by bluechip platforms. Is RCS with basic client-server encryption any less secure than Sunbird—not really.
Apple’s RCS deployment won’t be end-to-end encrypted, and so doesn’t fix the blue-bubble issue. Sunbird can color its bubbles any way it likes, but end-to-end encryption is a binary, and its solution isn’t. As such, the bubbles should be green—just as we assume Google Messages will be, even under RCS.
And so back to that stark reminder. Unless Apple either collaborates with Google to create an end-to-end encrypted cross-platform layer atop RCS, or Apple develops an Android app, or Apple opens its SMS/RCS API to enable Google Messages to create an iOS app, there will be no cross-platform, secure messaging between iPhone and Android that doesn’t involve an over-the-top, standalone messaging platform.
iMessage is an excellent platform—as long as everyone is using it. There is no secure alternative. You should stop texting other SMS clients or to unified messengers with iMessage conduits. iMessage should just be for iMessages.
Continue to use iMessage for OTPs and where your friends and family also live inside Apple’s walled garden—a long list if you’re in the US and a shorter list elsewhere. But for everything else, use a cross-platform alternative that is end-to-end encrypted.
You have plenty of choice—WhatsApp, Signal, even Facebook Messenger. But not a third-party relay to iMessage—because even if it delivers exactly as promised, it’s simply not as secure as the alternatives and—absent a complete change of approach from Apple or a new RCS protocol—it never can be.
Read the full article here
