227
submitted 8 months ago* (last edited 8 months ago) by CorrodedCranium@leminal.space to c/privacy@lemmy.ml

It seems like the benefits are having the device lock/wipe itself after a set amount of attempts in case of a brute force attack and not having to run software to decrypt the drive on the device you plug it into.

I included a picture of the IronKey Keypad 200 but that's just because it's the first result that came up when I was looking for an example. There seem to be a few other manufacturers and models out there and they probably have different features.

I am curious what do you think of them? Do you think they are useful? Do you find it more a novelty?


It was an ExplainingComputers video titled Very Useful Small Computing Things that made me think of them.

top 50 comments
sorted by: hot top controversial new old
[-] ryannathans@aussie.zone 115 points 8 months ago

Nice just look at the most worn buttons

[-] WarmSoda@lemm.ee 47 points 8 months ago

Damn. Dude just comes in and ends the entire discussion.

[-] CorrodedCranium@leminal.space 27 points 8 months ago* (last edited 8 months ago)

It seems like these drives can use up to 15 digit pins and lock out after a set number of attempts. I don't know if that would be a huge issue

[-] ninpnin@sopuli.xyz 15 points 8 months ago* (last edited 8 months ago)

Permutations have entered the chat

[-] NuXCOM_90Percent@lemmy.zip 12 points 8 months ago* (last edited 8 months ago)

It still drastically narrows down the search space and makes social engineering a LOT easier.

Because you tend to have one of two sources for any password that people need to remember.

  1. Randomly generated with no rhyme or reason. And written down on a sticky note as a result
  2. Something with meaning to the user

And it is the latter where this becomes an issue. Because let's say they are a 50 year old and 1, 4, 6, 7, and 9 are heavily worn. Well, they were born in the 70s so let's verify exactly when. Hmm, May. No 5 means it probably isn't their birthday. Wait... their partner was born on April 7th, 1976. No luck. Oh, but what if they were clever and it is actually 197647 instead of 471976? Boom, in.

[-] CorrodedCranium@leminal.space 9 points 8 months ago* (last edited 8 months ago)

Related XKCD

It's a shame more people don't think of obscure numbers they've been forced to remember in the past or see constantly and use those.

  • A number from a song

  • Your middle school locker combination

  • The number of a local pizza place

  • Your library card number

  • The barcode number on something you carry around all the time

If you combined any two of those I imagine it would make for a pretty secure password.

load more comments (9 replies)
load more comments (1 replies)
[-] solrize@lemmy.world 51 points 8 months ago* (last edited 8 months ago)

Ironkey has been more careful than some other vendors but the concept still seems dubious to me, if you are trying to stop serious attackers. You want the decryption key to be completely separated from the storage.

[-] CorrodedCranium@leminal.space 10 points 8 months ago* (last edited 8 months ago)

Ironkey has been more careful than some other vendors

In what aspects? I don't know much about these specific devices

[-] solrize@lemmy.world 11 points 8 months ago* (last edited 8 months ago)

Cryptography and tamper resistance implementation. E.g. search "ironkey fips certification". Ironkey is a Kingston brand now though, and Kingston has traditionally been crap, so be careful. Anyway if it's for run of the mill personal files where you just want some extra protection, the device is probably ok if you don't mind the semi-ridiculous cost. This is interesting though: https://www.wired.com/story/unciphered-ironkey-password-cracking-bitcoin/

Also a teardown report: https://hardwear.io/netherlands-2021/presentation/teardown-and-feasibility-study-of-IronKey.pdf

There are more serious technical approaches to data protection, but fairly quickly the weak spot becomes the humans in the loop, which are harder to handle with pure technology.

load more comments (3 replies)
load more comments (2 replies)
[-] delirious_owl@discuss.online 43 points 8 months ago

Do encryption in software. History taught us hard lessons about this.

[-] CorrodedCranium@leminal.space 13 points 8 months ago* (last edited 8 months ago)

Can you think of some notable examples of hardware based encryption failing?

Besides the actual device dying I mean

[-] jwt@programming.dev 8 points 8 months ago* (last edited 8 months ago)
[-] PipedLinkBot@feddit.rocks 7 points 8 months ago

Here is an alternative Piped link(s):

https://m.piped.video/watch?v=beMtNM7nwfQ

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source; check me out at GitHub.

load more comments (2 replies)
load more comments (4 replies)
[-] csm10495@sh.itjust.works 40 points 8 months ago

I had one of the SanDisk flash drives that had some launcher thing on it and I had a password for some reason on it.

In high school, a classmate tried to guess it, 3 times and I lost everything on it forever, since it stupidly locked forever after 3 tries.

I had software projects from back then that I can never get back.. including a web browser. I could have had the next Firefox..

If you're out there, Liz: I'll never forgive that.

[-] TonyTonyChopper@mander.xyz 10 points 8 months ago

Liz taught you to make backups of data you value

[-] THE_MASTERMIND@feddit.ch 6 points 8 months ago

Was it going to be open source ?

[-] csm10495@sh.itjust.works 14 points 8 months ago

I didn't know what that was yet.. but probably.

[-] makeasnek@lemmy.ml 29 points 8 months ago* (last edited 8 months ago)

Hardware signing devices have lots of utility because they keep the key from ever being on the machine (which is more likely to be compomised). Think ledger or trezor for your Bitcoin. Hardware encryption devices are just really expensive and black-box ways to avoid Veracrypt.

If your encryption algorithm is secure, you have no use for automatic lock-out. If it's not, automatic lockout won't do much against an attacker with physical access to the device. Unless they are dumb enough to trigger the lockout AND the internal memory wipes itself sufficiently well AND/OR the attacker doesn't have the resources to reverse engineer the device.

load more comments (1 replies)
[-] hanke@feddit.nu 27 points 8 months ago
[-] Toribor@corndog.social 19 points 8 months ago

Like most things, it's important to remember what threats you're trying to protect yourself against.

Are you trying to protect yourself against dropping a USB in a parking lot and someone picking it up? Or are you trying to protect yourself from a nation state?

[-] potatopotato@sh.itjust.works 9 points 8 months ago

Just my opinion but I don't really like the common belief of separating nation and non nation state actors. We're getting to the point where nation states are making up a large portion of the really damaging attacks, and it's frequently ones own government or a government they're in conflict with which means there are very kinetic consequences for failure even if you're a nobody. It's not just someone stealing some money anymore.

load more comments (1 replies)
[-] Imprint9816@lemmy.dbzer0.com 20 points 8 months ago

Yeah i dont see how this would be better then a run of the mill thumb drive (that doesnt scream im worth stealing) and just creating a cryptomator vault on it.

load more comments (6 replies)
[-] alphafalcon@feddit.de 19 points 8 months ago

They occupy a strange niche full of contradictions.

Entering the code on the device itself should increase security as opposed to entering it on a compromised computer.

But plugging it into a compromised computer means the data is compromised anyway.

Their security is way harder to audit than a software solution like PGP. The actual "encryption" varies from actual decent setups to "entering the code connects the data pins with no actual encryption on the storage chip"

Not having to instal/use software to use them means they are suitable for non-technical users which in turn means more support calls for "I forgot the pin, it wiped itself, can you restore my data"

They are kind of useful to check the "data is transported on encrypted media" box for compliance reasons without having to manage something bigger.

[-] AnnaFrankfurter@lemmy.ml 19 points 8 months ago
[-] YeetPics@mander.xyz 18 points 8 months ago* (last edited 8 months ago)

These are handy if you have to move sensitive information but I've experienced more than one event at work where irreplaceable files were lost due to user error on these type of drives.

I couldn't tell you about the lifespan of these devices either, something tells me the keys won't last more than a few years if it's being used regularly.

load more comments (2 replies)
[-] Gooey0210@sh.itjust.works 16 points 8 months ago

Looks find to me, depending on your use case, everything would have a use case

Many people mention airport red flags and checks, for me I never had any issues with the airport stuff, except one time in China when I had a full case of wires, really 10kg of wires, and they just asked me me to open and show, np

[-] CosmicApe@kbin.social 21 points 8 months ago

Why did you have a 10kg bag of wires?

[-] BeMoreCareful@lemmy.world 32 points 8 months ago

What, do you work at a Chinese airport or something?

[-] CosmicApe@kbin.social 14 points 8 months ago

I'm the one asking questions here!

[-] GBU_28@lemm.ee 7 points 8 months ago

What's your spaghetti policy here

load more comments (1 replies)
[-] Gooey0210@sh.itjust.works 10 points 8 months ago

I like wires! Who doesn't like wires??

I donct have much stuff, but i have a lot of electronics, and at that moment i was very into sdr, so, wires, antennas, adapters, antennas, wires, and also additional hdmis, vgas, ethernet cables, usb, chargers, etc, etc, etc

[-] CosmicApe@kbin.social 7 points 8 months ago

Fair, I do like wires

load more comments (3 replies)
[-] delirious_owl@discuss.online 8 points 8 months ago

What do you buy when you're in China. Dude wanted cheap wires. Let him have his cheap wires.

load more comments (1 replies)
[-] NabeGewell@lemmy.world 16 points 8 months ago

I wouldn't trust any part of its hardware and software to store anything worth encrypting on it

[-] kjake@infosec.pub 13 points 8 months ago

The ones that went through FIPS 140-2 Type 3 or above validation are legit. We used Apricorn for CUI data…examples: https://www.archives.gov/cui/registry/category-list

[-] Count042@lemmy.ml 13 points 8 months ago

I don't trust hardware implementations of encryption in the same way I don't trust hardware raid arrays.

[-] GolfNovemberUniform@lemmy.ml 11 points 8 months ago

Too expensive. Use software encryption instead

[-] Dyskolos@lemmy.zip 11 points 8 months ago

Useful for what? Hiding stuff from family-member or coworkers? Yeah sure. Why not.

Hiding stuff from professionals that really want your data? Probably not very helpful.

Also what about backup? One controller-malfunction and your stuff goes poof. I just assume the data is somehow important or else you wouldn't care about such a device 😊

load more comments (5 replies)
[-] morgin@lemm.ee 8 points 8 months ago

like everyone else has said hardware level encryption doesn’t seem like the most sound option.

Personally i’ve just encrypted sensitive files with picocrypt, only just started looking into better encryption techniques though so there’s probably better alternatives.

[-] MonkderZweite@feddit.ch 8 points 8 months ago* (last edited 8 months ago)

Same problems as any firmware based encryption (encrypting SSDs, etc.). Firmware is quickly outdated and the triangle price - speed - security usually neglects the security part.

[-] tiredofsametab@kbin.run 8 points 8 months ago

First time I've seen something like that, but my initial thought was: wow, that's a lot of parts that can break and things that can go wrong (compared to only encrypting the data itself before storage).

[-] Churbleyimyam@lemm.ee 7 points 8 months ago

Good until you spill a Cuppasoup on it's chinesium keyboard.

[-] Jiggle_Physics@lemmy.world 7 points 8 months ago

As long as the security software it uses is solid I think it's a decent idea.

[-] fruitycoder@sh.itjust.works 6 points 8 months ago

Stopping low effort attempts to get data it seems good, as an addition too software encryption it seems great. Of course hardware can range from child toys, gimmicks, to serious hardened hardware, so results WILL vary.

load more comments
view more: next ›
this post was submitted on 19 Feb 2024
227 points (97.5% liked)

Privacy

31601 readers
637 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS