It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having anyone review the design and approve it. They must have known it was nothing they pretended and still decide to sell it.

"How did you get the data?"

"It was just an unencrypted SD card inside"

Not very exciting, but I guess just as accurate as reality!

1. Anyone who has access to the drive likely also has a nice sample of your fingerprint on the same device.

2. Hardware encryption implementations are often unknown, flawed, or completely missing. You shouldn't place trust in obscurity.

3. Hardware encryption often adds an unnecessary point of failure. I've seen drives with hardware encryption implemented on a daughter board become unrecoverable because the daughter board failed, even though the drive itself was just fine.

Put a software encrypted volume on a normal storage device and call it a day. Don't pay extra to do worse.

https://www.cl.cam.ac.uk/~sps32/IronKey_teardown.pdf

You shouldn't trust that these things are secure.

We know that Microsoft's bitlocker had at least one backdoor. Lenovo's fingerprint USB also has backdoors.

It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt. Then again, who guarantees that the executables are actually build from the source? Or that the keys aren't somehow sent over to agencies by the operating system?

TLDR, we cannot realistically trust anything in this dictatorship of mass surveillance.

I turned an old android into a fingerprint USB and a fido2 in one shot.

The fingerprint USB is actually legit since it's backed by a closed bio metric on device.

What am I missing here?

> The fingerprint only switched the USB connection on; nothing on the card was encrypted.