News for hackers. Stuff that matters.
Re:Lenovo's 'encrypted' fingerprint USB is just an unencrypt... by steelframe on Sunday November 01, 2026 @11:03AM (#50326863)
If you own an Android device, your disk encryption is most likely provided via a UFS/eMMC hardware component known as the "Inline Cryptographic Engine" (ICE). Reputable device manufacturers validate the ciphertext that these devices write out to storage in a test environment by running the plaintext through a software encryption process using the same encryption keys as the OS provides to the ICE. If the ciphertexts match, then it would be unlikely that the hardware encryption engine isn't doing its job right.
Re:Lenovo's 'encrypted' fingerprint USB is just an unencrypt... by close04 on Sunday November 01, 2026 @11:51AM (#50327308)
That’s not validating an implementation. You’re just comparing the output for a few known inputs to known results.

The hardware is still a black box and you’ll never know how it behaves in conditions you didn't test against.

Re:Lenovo's 'encrypted' fingerprint USB is just an unencrypt... by steelframe on Sunday November 01, 2026 @01:22PM (#50328183)
Why do you trust the device you're posting this from? I presume you use it for private browsing, banking, email, and so forth.
Re:Lenovo's 'encrypted' fingerprint USB is just an unencrypt... by buran77 on Sunday November 01, 2026 @03:10PM (#50329251)
A general purpose computing device is unavoidable, it's exceedingly difficult to build anything close to it. Encrypted storage is trivial without dedicated hardware, using open, validated software solutions. Even better, if bugs or backdoors are found you don't need to throw out your encrypted stick, just update the software or reencrypt.

Because what I said above might sound like black magic to anyone who knows nothing about the topic I will expand.

The CPU on which the software runs gets far more scrutiny than the obscure encryption engine on the USB stick. And it's possible to validate the software encryption with minimal effort. Verify the output with various software implementations of the same algorithm, ran on different CPUs. They have to be compatible and can't all have the same bug or backdoor.

An encrypted stick is impossible to validate by the end user. They have no access to the CPU encryption engine or the raw storage so can't know the algorithm implementation, or the output to disk format which is probably proprietary.

Re:Lenovo's 'encrypted' fingerprint USB is just an unencrypt... by magicalhippo on Sunday November 01, 2026 @01:45PM (#50328417)
You didn't build your computer from discrete transistors[1]?

[1]: https://www.megaprocessor.com/index.html

Re:Lenovo's 'encrypted' fingerprint USB is just an unencrypt... by my123 on Sunday November 01, 2026 @12:57PM (#50327931)
The inline crypto engine is in the SoC for the phone case. Inline crypto engines for OPAL on the storage device side have a far worse security record.