Hacker News new | past | comments | ask | show | jobs | submit
alright2565 | on: Lenovo's 'encrypted' fingerprint USB is just an unencrypted SD card in a case
I've been required to use similar products due to government regulations. Personally I never trusted them, and I would have loved to take 15 minutes poking around in them, but it was the government who mandated their use for their data so ultimately it was out of my hands.
sllabres | parent | next
Was it probably a IronKey? They had a Homeland Security grant, I've used one then. To me software had some advantages. Easy backup of the encrypted data without a dependency to the hardware. IIRC this was somehow solved on the IronKey. Not a black box for the user which have to trust. My main problem with a software solution for me is the entry of the password which I have to do on a probably compromised computer.

The original IronKey (later sold to Kingston) seems to have be cracked. A team / company called Unciphered managed to break a IronKey in a attempt to offer such a decryption to Stefan Thomas who had 7002 bitcoin on this key. This was then worth then 235 million dollar (now >500 million), which is of course a VERY strong motivation. [1]

The Lenovo case of course seems not to be bad implemented security but no security at all, especially if they advertise with encryption, which I found on a Asian Lenovo website where still there are still some specs of the key [2]. A good method if you want to damage your reputation.

[1] https://www.wired.com/story/unciphered-ironkey-password-crac...

[2] https://tk.lenovo.com.cn/product/1003497.html

wildzzz | root | parent | next
I like using the Apricorn keypad flash drives. Like this Lenovo, it's doesn't connect until you unlock it. Password entry is via the built-in keypad so no software is necessary. It's also got a small battery so you can unlock it before you plug it which could prevent someone sniffing the USB 5V rail for any noise. Needing an app makes the Ironkey useless for anything that isn't running a normal desktop OS.
angry_octet | root | parent
All the devices with keypads are extremely vulnerable to hardware MITM of the keyboard/display. Same with the fingerprint ones. They rarely have secure elements so the PIN is also a weakness. And of course many of them just store the key internally instead of using a key stretching function, or don't do enough rounds, or use weak randomness.

For key entry you really want mutual TOTP or a separate ignition key, like a yubikey, that you insert into the drive.

noir_lord | root | parent
> This was then worth then 235 million dollar (now >500 million)

Says a lot about Bit Coin volatility that that didn't really narrow how long ago it was.

2023 for anyone else who wonders (the linked wired article is worth a read though).

mikeryan | parent | next
Ironically the DOJ isn’t great at this. Infamously they just gave California an encrypted thumb drive with 20,000 names of, allegedly, non-citizens registered to vote.

The password was included on a sticky note in the package.

loading story #50331044
functionmouse | parent
That's just the thing; these devices aren't meant to be -good-, they're meant to check boxes.
loading story #50333540