Lenovo's 'encrypted' fingerprint USB is just an unencrypted SD card in a case

mzajc

Linked article: https://www.tomshardware.com/tech-industry/cyber-security/le...

matheusmoreira

Does anyone actually trust these products? Always seemed like a terrible idea to me. The correct solution is to use free software cryptography on top of these things.

nik282000

Marketing wank made to sell e-waste to middle management.

ctkhn

Didn't expect something this crazy but I will not trust stuff like this until I've seen a teardown. Imagine being the product manager who approved this shit

jagged-chisel

Why a link to Reddit instead of the link to Tom’s Hardware?

dpacmittal

Just use veracrypt or ecrypt on any memory card. These devices don't deserve the premium they charge for on-device encryption which in this case is not even encyrypted

judge2020

Were semicolons in subheadings common before AI? This subheading of the TomsHardware article just seems very artificial: > The fingerprint only switched the USB connection on; nothing on the card was encrypted.

mytailorisrich

Well it's called FU after all...

untessela

Can anyone find a product listing where this was actually for sale? I couldn't.

l0new0lf-G

How much hardware and even software that is supposedly used for encryption is actually backdoored? We know that Microsoft's bitlocker had at least one backdoor. Lenovo's fingerprint USB also has backdoors. It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt. Then again, who guarantees that the executables are actually build from the source? Or that the keys aren't somehow sent over to agencies by the operating system? TLDR, we cannot realistically trust anything in this dictatorship of mass surveillance.

aliasxneo

I can imagine some "Hollywood hacker" scene where the guy steals an encrypted USB and proceeds to break into it. "How did you get the data?" "It was just an unencrypted SD card inside" Not very exciting, but I guess just as accurate as reality!

RobotToaster

This could've been rendered relatively secure had the USB stick been potted, but I guess that would've cost an extra few cents. https://en.wikipedia.org/wiki/Potting_(electronics)

Retr0id

This should be illegal. And maybe it already is? What consequences will Lenovo face, if any?

aftbit

Why would they do it this way? If they're going to add a custom controller on the outside, why not make it encrypt before writing to the SD card?

forgotpwd16

Interesting those those news are quite late, probably because it (and the entire ThinkPlus USB lineup) wasn't available outside CN. The product was first announced 2019, the flaw was found Aug 2025, CVE-2025-13453 was issued early Jan, and Li's presentation was in Mar.

jqpabc123

Just buy a standard USB drive and encrypt it with Bitlocker. If you hate MS then use Veracrypt. What am I missing here?

charles_f

I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer. It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having anyone review the design and approve it. They must have known it was nothing they pretended and still decide to sell it.

hosteur

So basically fraud? I’m sure the responsible people are getting fired and fined/jailed.

throwaway27448

Surely this is straight fraud?

xp84

I feel like there’s a mismatch between what this is designed for and what people are assuming it’s for (plus no doubt hyperbolic marketing). Clearly this was designed to keep your files from your roommate or kid’s prying eyes, and not to keep military secrets or your plans to overthrow the government.