Hacker News new | past | comments | ask | show | jobs | submit
OptionOfT | on: Lenovo's 'encrypted' fingerprint USB is just an unencrypted SD card in a case
We used these: https://apricorn.com/aegis-padlock-usb3

They work well in high security environments because you can allowlist the vendor and product id of only these hard drives, and you don't have to set up procedures where people HAVE to encrypt their drives before use.

So cost-wise it makes sense.

But for personal use? BitLocker / VeraCrypt all the way.

lifeisloving | parent | next
MS stores your Bitlocker keys on Microsoft servers now if you ever login with a OneDrive account, at least they were.

And MS has handed those keys over to law enforcement before.

caymanjim | root | parent | next
That's how it works by default, but you don't have to use it that way. BitLocker can be used securely.
ByteOfWood | root | parent
You should not be trusting a company or product that has been known to give up keys, regardless of how you are using it. Too risky
saidnooneever | root | parent | next
people rolling windows and saying high security environment in the same phrase are likely not aware what is a highly secured environment in the first place so it doesnt matter where those keys are -_-. I have never encountered these types of devices nor windows in a high secure environment. free software and BSD. Occasionally Linux but that is also mostly avoided or manually tampered with / built and hardnened to get around its rubbish security. sometimes there is an alternate deployment linux based (very hardened) in the event of a security issue on the other more secure platform in case that one does happen to spring a leak. (might be more needed now its easier to pick apart these systems).

some highly secure environments have connections comming from networks that sport windows. usually they will come in via something like a data diode so whatever comes in can physically not come out because its so risky to allow even such a network to connect to yours....

perceptions of what is highly secure can vary a lot depending on what a person has encountered. if you ever come across a place that is really secure u'll immediately know the difference.

ive never seen a highly secure corporate network and have seen close up what security is implemented in fortune100 etc. its a doozey. they just pay vendors with big retainers for IR etc. to be compliant and insured. that is not security. (and they spend millions on that which is funny as hell)

PorciiVorbesc | root | parent
>nor windows in a high secure environment

I have. We had an air-gapped network for ingesting and processing the deliverables and results of security audits and pen-tests at work. It was running windows and not Linux/BSD like the laptops of the pentesters, because most of our customers were MS shops so all deliverables we got from them were mostly documents, apps and files that were designed for Windows apps or had better compatibility on MS Office, and businesses stay solvent by conforming to their customers' needs instead of fighting them.

InvisibleUp | root | parent
I suppose it works if your threat model is corporate espionage and not state actors.
chasd00 | parent
You can probably implement your own these days. I would use a model to generate a requirement document, then human review, then generate an implementation plan, then human review, then take it to build. Have a different model to a code review and testing. End with human code review and testing.

You could make your own BitLocker conforming to your requirements without relying on or trusting any cloud or corporate entity.

fn-mote | root | parent
And then turn Mythos onto your code to make sure you don’t have vulnerabilities? That’s a lot of faith in the security of LLM-written code that I wouldn’t have in human-written code.
chasd00 | root | parent | next
The point is the code is there in front of you. You can audit it, study it, turn mod and after model loose on it, do whatever you want. You’re going to have to compile it so you need to trust the compiler but at least it’s not some cloud provider.
hparadiz | root | parent
Been daily driving this for a month

https://github.com/hparadiz/nexus-6p-biokey

I mean it's better than this sdcard thing at least.