Live data from Hacker News

An analysis of the Nomx secure communications device

scotthelme.co.uk

11–20 of 77 posts

Re: An analysis of the Nomx secure communications device

#11
post #6

TL;DR: It's $199 to $399 for a plastic case literally just containing a Raspberry Pi 3 Model B, running an outdated Raspian, and the software stack is extremely poorly developed. eg: their "secure handshake between devices" is basically two devices serving SMTP on port 26 instead of port 25.

Its port 26 enforces TLS though.

Re: An analysis of the Nomx secure communications device

#12
post #4

I don't understand the point of this, even if it worked correctly. If I understand correctly what it does is create some kind of secure tunnel between two nomx devices if you tell it to. But doesn't starttls do that already if you configure your mail server that way? And it already just works with any compliant email server? So unless I'm missing something there's absolutely no doubt in my mind that this is a scam. K…

The thing I think it is trying to do is enforce that TLS is used for the known domains. Starttls as implemented in most SMTP servers normally allows fallback to non-encrypted delivery (it's opportunistic).

This kind of agreed upon enforcement has been possible in many email products for years though (I worked on one which could do it about 10 years ago).

Re: An analysis of the Nomx secure communications device

#14
post #11
post #6

TL;DR: It's $199 to $399 for a plastic case literally just containing a Raspberry Pi 3 Model B, running an outdated Raspian, and the software stack is extremely poorly developed. eg: their "secure handshake between devices" is basically two devices serving SMTP on port 26 instead of port 25.

Its port 26 enforces TLS though.

[deleted]

Re: An analysis of the Nomx secure communications device

#15
post #4

I don't understand the point of this, even if it worked correctly. If I understand correctly what it does is create some kind of secure tunnel between two nomx devices if you tell it to. But doesn't starttls do that already if you configure your mail server that way? And it already just works with any compliant email server? So unless I'm missing something there's absolutely no doubt in my mind that this is a scam. K…

It sends directly (using TLS) to port 26 on the other "handshake" device i.e. not relaying through any third party such as an ISP.

I guess there's some theoretical benefit possible there but if you're worried about your ISP reading your email, just use GPG.

Re: An analysis of the Nomx secure communications device

#16
post #13

Can't wait for their $10k bounty program to go public. That will be an easy win for whoever submits first.

The article mentions that the bounty private key(s) would be embedded within the device, so I don't think a submission would be necessary.

Re: An analysis of the Nomx secure communications device

#18
post #11
post #6

TL;DR: It's $199 to $399 for a plastic case literally just containing a Raspberry Pi 3 Model B, running an outdated Raspian, and the software stack is extremely poorly developed. eg: their "secure handshake between devices" is basically two devices serving SMTP on port 26 instead of port 25.

Its port 26 enforces TLS though.

But doesn't bother to check if the certs (local and remote server) have been signed by a trusted authority. Nor does it attempt to pin these certs.

It provides encryption, but no authentication nor authorisation. In short an ever so slight improvement over normal SMTP.

Re: An analysis of the Nomx secure communications device

#19
I find these kinds of stories infuriating (and just a bit frustrating). Charlatans repackage, rebrand, and repurpose FOSS, then sell them at an unrealistic markup to unsuspecting dupes. Anything from PABX or VoIP systems based on Asterisk, through overly complex CMS's based on Wordpress. I'm not sure what riles me more: consumers being ripped off by these products, or the fact that my strengths lie in tech rather than sales.
Post reply on HN