I've been required to use similar products due to government regulations. Personally I never trusted them, and I would have loved to take 15 minutes poking around in them, but it was the government who mandated their use for their data so ultimately it was out of my hands.
Was it probably a IronKey? They had a Homeland Security grant, I've used one then.
To me software had some advantages. Easy backup of the encrypted data without a dependency to the hardware. IIRC this was somehow solved on the IronKey. Not a black box for the user which have to trust.
My main problem with a software solution for me is the entry of the password which I have to do on a probably compromised computer.
The original IronKey (later sold to Kingston) seems to have be cracked.
A team / company called Unciphered managed to break a IronKey in a attempt to offer such a decryption to Stefan Thomas who had 7002 bitcoin on this key.
This was then worth then 235 million dollar (now >500 million), which is of course a VERY strong motivation. [1]
The Lenovo case of course seems not to be bad implemented security but no security at all, especially if they advertise with encryption, which I found on a Asian Lenovo website where still there are still some specs of the key [2].
A good method if you want to damage your reputation.
I like using the Apricorn keypad flash drives. Like this Lenovo, it's doesn't connect until you unlock it. Password entry is via the built-in keypad so no software is necessary. It's also got a small battery so you can unlock it before you plug it which could prevent someone sniffing the USB 5V rail for any noise. Needing an app makes the Ironkey useless for anything that isn't running a normal desktop OS.
All the devices with keypads are extremely vulnerable to hardware MITM of the keyboard/display. Same with the fingerprint ones. They rarely have secure elements so the PIN is also a weakness. And of course many of them just store the key internally instead of using a key stretching function, or don't do enough rounds, or use weak randomness.
For key entry you really want mutual TOTP or a separate ignition key, like a yubikey, that you insert into the drive.
Ironically the DOJ isn’t great at this. Infamously they just gave California an encrypted thumb drive with 20,000 names of, allegedly, non-citizens registered to vote.
The password was included on a sticky note in the package.
That's exactly it. I donated to a candidate once (literally once, ever) and the party basically passes my phone number around to every PAC and campaign organization under the sun.
This stuff must be effective or else they wouldn't do it. On the other hand, it seems like a good way to discourage repeat donors. Why would I donate any money if the result is going to be endless texts and emails?
Heck, maybe they should offer a "premium donation" where you pay extra to not get on these lists, analogous to a no-ads streaming plan.
You are good! You had no obligation to keep that to yourself. The person in the wrong here was the CEO who failed to take basic steps to protect private information.
reply