Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An analysis of the Nomx secure communications device

scotthelme.co.uk

Post reply on HN
Print view View original

51–60 of 77 posts

Re: An analysis of the Nomx secure communications device

#51

Post by kens »

I read through the patent application cited in the article [1] so I can explain what the device is supposed to be doing.

The "secret sauce" is it can send email between two Nomx devices without using DNS or other third party servers, avoiding DNS attacks. The handshake between two devices sets up DNS records on each device so they can locally resolve each other. There's a mechanism so if a device changes IP address, it informs the other paired devices, with some sort of authentication.

So, it's not just a standard email server running on a RasPi, but does have something new. (To be clear, I'm not defending this device, just explaining what I learned from the patent.)

It's suspicious that the article's author didn't see any network traffic between devices when the handshake was set up, which makes me wonder how much of this is implemented. A couple followup experiments the author could do: a) verify that the device doesn't do an external DNS after the handshake. b) see if changing one device's IP address causes the other to get updated.

[1] https://patentscope.wipo.int/search/en/detail.jsf?docId=WO20...

Re: An analysis of the Nomx secure communications device

#52

Post by justinsaccount »

kens wrote: post #51

I read through the patent application cited in the article [1] so I can explain what the device is supposed to be doing. The "secret sauce" is it can send email between two Nomx devices without using DNS or other third party servers, avoiding DNS attacks. The handshake between two devices sets up DNS records on each device so they can locally resolve each other. There's a mechanism so if a device changes IP address,…

> There's a mechanism so if a device changes IP address, it informs the other paired devices, with some sort of authentication.

Except there appears to be no evidence that there is such a mechanism.

and as i336_ here stressed:

"The device is designed to send TLS-encrypted mail from nomx device to nomx device on port 26, BUT IT IS ENCRYPTING USING THE DEFAULT Postfix "snakeoil" TLS CERTIFICATE."

Re: An analysis of the Nomx secure communications device

#53

Post by woah »

cronjobber wrote: post #31
socket0 wrote: post #19

I find these kinds of stories infuriating (and just a bit frustrating). Charlatans repackage, rebrand, and repurpose FOSS, then sell them at an unrealistic markup to unsuspecting dupes. Anything from PABX or VoIP systems based on Asterisk, through overly complex CMS's based on Wordpress. I'm not sure what riles me more: consumers being ripped off by these products, or the fact that my strengths lie in tech rather tha…

The FSF has always made clear that they don't have any problem with people selling Free Software; it's about freedom, not low low price. (What infuriates me about this story is that it reminds me of how far companies like Google have destroyed Mail as a protocol usable without their intermediation. Use Googlemail or get your mails spam-binned.)

It's a broken federated system with a huge DOS vulnerability (spam). That's not Google's fault.

Re: An analysis of the Nomx secure communications device

#54

Post by j_s »

mike-cardwell wrote: post #43
timthelion wrote: post #32

The real story here, is that if you try to set up your mail server so that you can send mail to a microsoft email server such as live or hotmail, you eventually end up here where they ask for a bribe: https://returnpath.com/solutions/email-deliverability-optimi... Nomx may be terrible, but it's not their fault you can't send mail to hotmail.com Edit: here is the price list for sending mail to hotmail.com https://retu…

For Microsoft/Hotmail, you'll want to register your IP with their feedback loop (Junk Mail Reporting Program): https://postmaster.live.com/snds/JMRP.aspx It's free. A bonus of this is that you get reports about emails from your IP that their users mark as spam.

Thanks Mike!

I know you work on a lot of email tools. What is your go-to resource when someone asks about deliverability? If you're written something up yourself I'd appreciate a link!

Re: An analysis of the Nomx secure communications device

#55

Post by tankenmate »

griffinmb wrote: post #50

Their response (on their homepage) is awful: http://nomx.com/ "nomx Passes Security Tests After Blogger Claims to Have Penetrated nomx - UK blogger makes false claims he can access nomx remotely - UK blogger fails to access nomx remotely"

Three sentences into "Security testing" section and you have to wonder if they have ever heard of an evil maid attack. Along with outdated kernels that have remote execution bugs, CSRF / XSS bugs, outdated versions of PHP, etc. You really have to wonder if they have any real world security knowledge or skills.

Re: An analysis of the Nomx secure communications device

#56

Post by cronjobber »

woah wrote: post #53
cronjobber wrote: post #31

Earlier quoted context omitted.

The FSF has always made clear that they don't have any problem with people selling Free Software; it's about freedom, not low low price. (What infuriates me about this story is that it reminds me of how far companies like Google have destroyed Mail as a protocol usable without their intermediation. Use Googlemail or get your mails spam-binned.)

It's a broken federated system with a huge DOS vulnerability (spam). That's not Google's fault.

Is the "solution" of pushing everybody onto a handful of centralized platforms entirely dictated by the nature of the problem?

Re: An analysis of the Nomx secure communications device

#57

Post by jstanley »

cronjobber wrote: post #31
socket0 wrote: post #19

I find these kinds of stories infuriating (and just a bit frustrating). Charlatans repackage, rebrand, and repurpose FOSS, then sell them at an unrealistic markup to unsuspecting dupes. Anything from PABX or VoIP systems based on Asterisk, through overly complex CMS's based on Wordpress. I'm not sure what riles me more: consumers being ripped off by these products, or the fact that my strengths lie in tech rather tha…

The FSF has always made clear that they don't have any problem with people selling Free Software; it's about freedom, not low low price. (What infuriates me about this story is that it reminds me of how far companies like Google have destroyed Mail as a protocol usable without their intermediation. Use Googlemail or get your mails spam-binned.)

> The FSF has always made clear that they don't have any problem with people selling Free Software

Though I don't think the FSF speaks on behalf of socket0, or vice versa.

Re: An analysis of the Nomx secure communications device

#58

Post by Analemma_ »

nrki wrote: post #13

Can't wait for their $10k bounty program to go public. That will be an easy win for whoever submits first.

The rampant goalpost-moving in their response suggests that they'll never actually pay out. I mean, their response to the author pointing out that it can be infected by drive-by malware sites is "don't visit those sites".

Re: An analysis of the Nomx secure communications device

#59

Post by lloeki »

tankenmate wrote: post #55
griffinmb wrote: post #50

Their response (on their homepage) is awful: http://nomx.com/ "nomx Passes Security Tests After Blogger Claims to Have Penetrated nomx - UK blogger makes false claims he can access nomx remotely - UK blogger fails to access nomx remotely"

Three sentences into "Security testing" section and you have to wonder if they have ever heard of an evil maid attack. Along with outdated kernels that have remote execution bugs, CSRF / XSS bugs, outdated versions of PHP, etc. You really have to wonder if they have any real world security knowledge or skills.

> You really have to wonder if they have any real world security knowledge or skills.

I wouldn't even be the least surprised if they turned out to be genuinely honest and convinced about their own skill.

I've talked to a guy that could tell you right in the eye that a HTTP redirection never hits the UA and goes straight to the second server so it's safe to pass plain credentials in there.

Another one goes out of its way to (please follow through) derive an AES256-CBC key from a user's password using PBKDF2, said key that ends up being sent over HTTP(not S) right along with the encrypted payload that turns out to include said password, but we're safe because that goldberguesque non-encryption is base64-encoded as a second layer. In a flash of foresight, as additional defense in depth, within that encryption the password is actually hashed by the client using plain SHA256, sent on the wire and compared as is with the db record. Please note the irony of using PBKDF2 nearby for the noop key. Well, when viewed as a whole the thing is ironic on so many levels and whatever the angle you look at it that at some point you have to convince yourself this is just an elaborate joke to keep any manner and composure.

Some people just don't get security. Or logic. Or computers. Yet they're being trusted into writing software and building systems, sometimes critical ones, sometimes medical ones. That, defies the mind.

Re: An analysis of the Nomx secure communications device

#60

Post by Kalium »

cronjobber wrote: post #56
woah wrote: post #53

Earlier quoted context omitted.

It's a broken federated system with a huge DOS vulnerability (spam). That's not Google's fault.

Is the "solution" of pushing everybody onto a handful of centralized platforms entirely dictated by the nature of the problem?

Of course not! A decentralized, federated solution where everyone running a service takes responsibility for their service and ensures high standards are adhered to is preferable, desirable, and possible.

So preferable, in fact, that professionals have tried! Extensively, exhaustively, and at great length. New standards have been devised. New protocols designed. Newer, more clever ideas pioneered and deployed.

Several decades of trying that approach with results being somewhat below what could be hoped for led users and administrators alike to look for alternatives.

The nature of the problem at hand is that in a highly decentralized system where the cost of use is borne by the receiver and breaking backwards compatibility isn't acceptable, it is extremely difficult to stem abuse. Measures that could stop or diminish abuse will not be taken by abusers, and the need to preserve backwards compatibility prevents cutting off both them and legitimate users on less modern services.

It's a shit scenario. It didn't have to be this way! Yet, there don't seem to be other options on offer that deliver equivalent or better benefits for equivalent or better costs in time and treasure.

Post reply on HN