Lenovo's 'encrypted' fingerprint USB is just an unencrypted SD card in a case
Lenovo, a name once synonymous with robust ThinkPads, has hilariously undershot expectations with an 'encrypted' fingerprint USB drive that turned out to be little more than an unencrypted SD card in a fancy case. HN is collectively facepalming at the sheer incompetence or outright fraudulent marketing, reigniting long-standing trust issues with the brand. This story serves as a stark reminder that if you want security, perhaps don't trust an opaque black box product and instead stick to verifiable open-source solutions.
The Lowdown
This story reveals a stark example of security theater: a Lenovo product marketed as a secure, AES-256 encrypted USB drive with biometric fingerprint access was found to be a sham. Tech enthusiasts discovered that the device was merely a standard, unencrypted SD card housed within a shell. The much-touted fingerprint sensor served only to enable or disable the USB connection to the system, offering no actual data encryption.
- Deceptive Design: The product, identified as Lenovo's "ThinkPlus FU100," promised robust data protection via AES-256 encryption and a fingerprint reader.
- Security Void: In reality, researchers found the internal SD card held data in plaintext, accessible by simply removing it from the USB casing and plugging it into any standard SD card reader.
- Fingerprint as a Switch: The fingerprint authentication mechanism did not unlock encrypted data but rather acted as a simple power switch, connecting or disconnecting the embedded SD card to the USB interface.
- Wider Implications: This discovery was part of a broader investigation into "secure" USB drives, revealing a pattern of poor implementation and false advertising in the market.
This revelation has sparked outrage and a renewed discussion on hardware security product trustworthiness, casting a shadow on corporate claims of data protection when verifiable implementation is absent. It underscores a critical lesson: trust, but verify – or, in this case, teardown.
The Gossip
Lenovo's Legacy: Laughable Lapses and Lingering Lack of Trust
Commenters expressed bewilderment and lack of surprise, citing Lenovo's past security incidents like the Superfish scandal as reasons to distrust the brand. Many questioned how such a product could pass any security review, suggesting gross incompetence or outright fraud. The discussion often veered into whether Lenovo, especially post-IBM ThinkPad acquisition, can still be considered a trustworthy hardware vendor for anything secure, with a general consensus leaning towards no. Some joked about the product's "FU100" name being indicative of its quality.
Crypto Conundrum: Commercial vs. Community Cryptography
A significant portion of the debate centered on the inherent trustworthiness of hardware-based encryption solutions versus free/open-source software cryptography. Many argued that verifiable open-source tools like VeraCrypt or BitLocker (used correctly) are superior due to transparency and auditability, with some dismissing all commercial 'secure' USB drives as snake oil. Others countered that hardware solutions, when properly implemented (e.g., using secure enclaves, TPMs, or robust key derivation functions with biometric protection), *could* offer benefits like brute-force resistance or ease of use for "normies" who can't handle complex software setups. However, the Lenovo incident was universally cited as proof that many hardware implementations are, at best, security theater, and at worst, outright fraudulent.
Fraudulent Futures: False Claims and Foreseeable Follies
Commenters debated the legal implications of Lenovo's misrepresentation, frequently calling it outright fraud and questioning what, if any, consequences the company would face. The consensus was that in many jurisdictions, especially the US, large corporations often escape significant penalties for such deceptions. The discussion also touched upon the concept of "security theater" – products designed to *look* secure or meet compliance checkboxes rather than provide actual protection. Some pointed out that for many users, this level of "security" might merely be to deter a casual snooper (like a roommate), not state-level adversaries, but agreed that advertising strong encryption when none exists is fundamentally dishonest.