3 ms·

I read through the patent application cited in the article [1] so I can explain what the device is supposed to be doing. The "secret sauce" is it can send emai

by kens 10y ago

I read through the patent application cited in the article [1] so I can explain what the device is supposed to be doing. The "secret sauce" is it can send email between two Nomx devices without using DNS or other third party servers, avoiding DNS attacks. The handshake between two devices sets up DNS records on each device so they can locally resolve each other. There's a mechanism so if a device changes IP address, it informs the other paired devices, with some sort of authentication. So, it's not just a standard email server running on a RasPi, but does have something new. (To be clear, I'm not defending this device, just explaining what I learned from the patent.) It's suspicious that the article's author didn't see any network traffic between devices when the handshake was set up, which makes me wonder how much of this is implemented. A couple followup experiments the author could do: a) verify that the device doesn't do an external DNS after the handshake. b) see if changing one device's IP address causes the other to get updated. [1] https://patentscope.wipo.int/search/en/detail.jsf?docId=WO2016160957 https://patentscope.wipo.int/search/en/detail.jsf?docId=WO20...

justinsaccount 10y ago
> There's a mechanism so if a device changes IP address, it informs the other paired devices, with some sort of authentication. Except there appears to be no evidence that there is such a mechanism. and as i336_ here stressed: "The device is designed to send TLS-encrypted mail from nomx device to nomx device on port 26, BUT IT IS ENCRYPTING USING THE DEFAULT Postfix "snakeoil" TLS CERTIFICATE."
MertsA 10y ago
From what the author found, it seems pretty clear to me that that patent is nothing more than an idea on paper right now. If the device doesn't send anything over the network for a "handshake" then it isn't a handshake at all. Also, I'm not sure if the author added detail or not but it makes it quite clear that the web interface simply adds a row to the handshake table with the fields entered and nothing else. He also found that the only other place in the GUI that references this table at all is to display the existing "handshakes". As far as how it actually works on the device the author also showed the relevant portion of the postfix config where it checks if the domain is in the handshake table and if it is then connect to that IP on port 26 with the hardcoded default cert. Maybe they plan on creating something based on that patent someday but right now what they're selling as based on that patent has nothing to do with it.

by kens 10y ago

justinsaccount 10y ago

> There's a mechanism so if a device changes IP address, it informs the other paired devices, with some sort of authentication. Except there appears to be no evidence that there is such a mechanism. and as i336_ here stressed: "The device is designed to send TLS-encrypted mail from nomx device to nomx device on port 26, BUT IT IS ENCRYPTING USING THE DEFAULT Postfix "snakeoil" TLS CERTIFICATE."

MertsA 10y ago

From what the author found, it seems pretty clear to me that that patent is nothing more than an idea on paper right now. If the device doesn't send anything over the network for a "handshake" then it isn't a handshake at all. Also, I'm not sure if the author added detail or not but it makes it quite clear that the web interface simply adds a row to the handshake table with the fields entered and nothing else. He also found that the only other place in the GUI that references this table at all is to display the existing "handshakes". As far as how it actually works on the device the author also showed the relevant portion of the postfix config where it checks if the domain is in the handshake table and if it is then connect to that IP on port 26 with the hardcoded default cert. Maybe they plan on creating something based on that patent someday but right now what they're selling as based on that patent has nothing to do with it.