Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

TL;DR:

It's $199 to $399 for a plastic case literally just containing a Raspberry Pi 3 Model B, running an outdated Raspian, and the software stack is extremely poorly developed. eg: their "secure handshake between devices" is basically two devices serving SMTP on port 26 instead of port 25.



Its port 26 enforces TLS though.


But doesn't bother to check if the certs (local and remote server) have been signed by a trusted authority. Nor does it attempt to pin these certs.

It provides encryption, but no authentication nor authorisation. In short an ever so slight improvement over normal SMTP.


It's actively ten thousand times worse than that. From the article:

> The device uses self-signed certs throughout and they aren't even device specific. It's using the default ssl-cert-snakeoil.pem and ssl-cert-snakeoil.key in the Postfix config.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: