Their response (on their homepage) is awful: http://nomx.com/
"nomx Passes Security Tests After Blogger Claims to Have Penetrated nomx
- UK blogger makes false claims he can access nomx remotely
- UK blogger fails to access nomx remotely"
"nomx Passes Security Tests After Blogger Claims to Have Penetrated nomx
- UK blogger makes false claims he can access nomx remotely
- UK blogger fails to access nomx remotely"
I wouldn't even be the least surprised if they turned out to be genuinely honest and convinced about their own skill.
I've talked to a guy that could tell you right in the eye that a HTTP redirection never hits the UA and goes straight to the second server so it's safe to pass plain credentials in there.
Another one goes out of its way to (please follow through) derive an AES256-CBC key from a user's password using PBKDF2, said key that ends up being sent over HTTP(not S) right along with the encrypted payload that turns out to include said password, but we're safe because that goldberguesque non-encryption is base64-encoded as a second layer. In a flash of foresight, as additional defense in depth, within that encryption the password is actually hashed by the client using plain SHA256, sent on the wire and compared as is with the db record. Please note the irony of using PBKDF2 nearby for the noop key. Well, when viewed as a whole the thing is ironic on so many levels and whatever the angle you look at it that at some point you have to convince yourself this is just an elaborate joke to keep any manner and composure.
Some people just don't get security. Or logic. Or computers. Yet they're being trusted into writing software and building systems, sometimes critical ones, sometimes medical ones. That, defies the mind.
http://www.bbc.co.uk/news/technology-38934822
> Addressing the issue of old software, he said Nomx planned to let users choose which updates should be applied to their device.
> "We will selectively allow users to pick and choose when that becomes available but today we're not forcing any types of updates," he said, adding that updates can introduce vulnerabilities.
> "Updates actually cause a cascading effect and now you're patching patches and that is not a good place to be in," he told Click.