HN

Need help?
<- Back
Lenovo's 'encrypted' fingerprint USB is just an unencrypted SD card in a case

Lenovo's 'encrypted' fingerprint USB is just an unencrypted SD card in a case

entryleveljobsc

Comments (110)

  • charles_f
    I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer.It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having anyone review the design and approve it. They must have known it was nothing they pretended and still decide to sell it.
  • matheusmoreira
    Does anyone actually trust these products? Always seemed like a terrible idea to me. The correct solution is to use free software cryptography on top of these things.
  • mzajc
  • aliasxneo
    I can imagine some "Hollywood hacker" scene where the guy steals an encrypted USB and proceeds to break into it."How did you get the data?""It was just an unencrypted SD card inside"Not very exciting, but I guess just as accurate as reality!
  • jagged-chisel
    Why a link to Reddit instead of the link to Tom’s Hardware?
  • forgotpwd16
    Interesting those those news are quite late, probably because it (and the entire ThinkPlus USB lineup) wasn't available outside CN. The product was first announced 2019, the flaw was found Aug 2025, CVE-2025-13453 was issued early Jan, and Li's presentation was in Mar.
  • jwr
    I always said that in-device encryption that you cannot verify is useless and considered those SATA drives with built-in encryption to be useless. Famous HN luminaries disagreed with me.
  • Retr0id
    This should be illegal. And maybe it already is? What consequences will Lenovo face, if any?
  • regus
    After the Superfish scandal Lenovo went on my “never buy anything from this company” list.
  • hparadiz
    https://github.com/hparadiz/nexus-6p-biokeyI turned an old android into a fingerprint USB and a fido2 in one shot.The fingerprint USB is actually legit since it's backed by a closed bio metric on device.
  • BatteryMountain
    Seems like a high-school project or a counterfeit item? If not, Lenovo messed up badly.
  • hosteur
    So basically fraud? I’m sure the responsible people are getting fired and fined/jailed.
  • thayne
    The name "FU100" makes this seem like it is a joke product, at the customers expense. Interestingly, I haven't been able to find a product listing for this except on chinese websites like Alibaba.
  • dennysora-main
    I don't know why, but I find it pretty funny.
  • nik282000
    Marketing wank made to sell e-waste to middle management.
  • xp84
    I feel like there’s a mismatch between what this is designed for and what people are assuming it’s for (plus no doubt hyperbolic marketing). Clearly this was designed to keep your files from your roommate or kid’s prying eyes, and not to keep military secrets or your plans to overthrow the government.
  • anon
    undefined
  • untessela
    Can anyone find a product listing where this was actually for sale? I couldn't.
  • RobotToaster
    This could've been rendered relatively secure had the USB stick been potted, but I guess that would've cost an extra few cents. https://en.wikipedia.org/wiki/Potting_(electronics)
  • aftbit
    Why would they do it this way? If they're going to add a custom controller on the outside, why not make it encrypt before writing to the SD card?
  • throwaway27448
    Surely this is straight fraud?
  • l0new0lf-G
    How much hardware and even software that is supposedly used for encryption is actually backdoored?We know that Microsoft's bitlocker had at least one backdoor. Lenovo's fingerprint USB also has backdoors.It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt. Then again, who guarantees that the executables are actually build from the source? Or that the keys aren't somehow sent over to agencies by the operating system?TLDR, we cannot realistically trust anything in this dictatorship of mass surveillance.
  • judge2020
    Were semicolons in subheadings common before AI? This subheading of the TomsHardware article just seems very artificial:> The fingerprint only switched the USB connection on; nothing on the card was encrypted.
  • ctkhn
    Didn't expect something this crazy but I will not trust stuff like this until I've seen a teardown. Imagine being the product manager who approved this shit
  • jqpabc123
    Just buy a standard USB drive and encrypt it with Bitlocker. If you hate MS then use Veracrypt.What am I missing here?
  • dpacmittal
    Just use veracrypt or ecrypt on any memory card. These devices don't deserve the premium they charge for on-device encryption which in this case is not even encyrypted
  • mytailorisrich
    Well it's called FU after all...