Does anyone actually trust these products? Always seemed like a terrible idea to me. The correct solution is to use free software cryptography on top of these things.
I've been required to use similar products due to government regulations. Personally I never trusted them, and I would have loved to take 15 minutes poking around in them, but it was the government who mandated their use for their data so ultimately it was out of my hands.
The overwhelming majority of people who use USB sticks for things are likely aware of security and the concept of encryption. But the idea of being able to use “free software cryptography on top” may as well be a trip to Mars.
Most "normies" I know think that open source cryptography is less secure because it's "open" (if they even know open source cryptography is a thing at all). No amount of trying to explain to them how more eyes on the source code generally equals safer encryption will sway most of them in the slightest.
>The correct solution is to use free software cryptography on top of these things.
If implemented correctly, "hardware" encryption can be more secure than "free software cryptography". The most obvious benefit is protection against brute-attacks, which you can't meaningfully implement with software. Not to mention added protection of biometric authentication as a second factor, compared to typing a password into a possibly untrusted machine.
“Correctly” is a big caveat. Almost no HW implementation is auditable in any way.
My baseline assumption is that even the good commercial products are only secure from a non-determined attacker, not TLAs. Anything safe from TLAs is what’s being sold only to them.
Software is insecure in many scenarios because endpoint security is abysmal. Of course, a USB stick with fingerprint reader cannot be secure but there is no way around hardware-based cryptography with independent key entry if you need real security. Then again, this won't help you if the secrets are transferred to the insecure endpoint anyway.
How much hardware and even software that is supposedly used for encryption is actually backdoored?
We know that Microsoft's bitlocker had at least one backdoor. Lenovo's fingerprint USB also has backdoors.
It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt. Then again, who guarantees that the executables are actually build from the source? Or that the keys aren't somehow sent over to agencies by the operating system?
TLDR, we cannot realistically trust anything in this dictatorship of mass surveillance.
>We know that Microsoft's bitlocker had at least one backdoor
Source? The closest I found was microsoft's key escrow system, but that's hardly a "backdoor" given it's publicly documented, and it's explicitly stated in no uncertain terms when you're setting it up[1]
Didn't expect something this crazy but I will not trust stuff like this until I've seen a teardown. Imagine being the product manager who approved this shit
Just use veracrypt or ecrypt on any memory card. These devices don't deserve the premium they charge for on-device encryption which in this case is not even encyrypted
If implemented correctly, "hardware" encryption can be more secure than "free software cryptography". The most obvious benefit is protection against brute-attacks, which you can't meaningfully implement with software. Not to mention added protection of biometric authentication as a second factor, compared to typing a password into a possibly untrusted machine.
My baseline assumption is that even the good commercial products are only secure from a non-determined attacker, not TLAs. Anything safe from TLAs is what’s being sold only to them.
(You actually have to go through https://binary.ninja/2026/10/22/breaking-more-encrypted-usb-... first :))
> The fingerprint only switched the USB connection on; nothing on the card was encrypted.
We know that Microsoft's bitlocker had at least one backdoor. Lenovo's fingerprint USB also has backdoors.
It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt. Then again, who guarantees that the executables are actually build from the source? Or that the keys aren't somehow sent over to agencies by the operating system?
TLDR, we cannot realistically trust anything in this dictatorship of mass surveillance.
Source? The closest I found was microsoft's key escrow system, but that's hardly a "backdoor" given it's publicly documented, and it's explicitly stated in no uncertain terms when you're setting it up[1]
[1] https://static0.howtogeekimages.com/wordpress/wp-content/upl...