Re:An analysis of the Nomx secure communications device
by JasuM on Thursday April 27, 2017 @06:04AM
(#14210368)
Its port 26 enforces TLS though.
Re:An analysis of the Nomx secure communications device
by tankenmate on Thursday April 27, 2017 @07:57AM
(#14210778)
But doesn't bother to check if the certs (local and remote server) have been signed by a trusted authority. Nor does it attempt to pin these certs.
It provides encryption, but no authentication nor authorisation. In short an ever so slight improvement over normal SMTP.
Re:An analysis of the Nomx secure communications device
by i336_ on Thursday April 27, 2017 @08:17AM
(#14210881)
It's actively ten thousand times worse than that. From the article:
> The device uses self-signed certs throughout and they aren't even device specific. It's using the default ssl-cert-snakeoil.pem and ssl-cert-snakeoil.key in the Postfix config.
It's $199 to $399 for a plastic case literally just containing a Raspberry Pi 3 Model B, running an outdated Raspian, and the software stack is extremely poorly developed. eg: their "secure handshake between devices" is basically two devices serving SMTP on port 26 instead of port 25.