Lenovo's 'encrypted' fingerprint USB is just an unencrypted SD card in a case

Original Article ↗ Hacker News Discussion ↗

Lenovo’s Thinkplus FU100 “encrypted” fingerprint USB drive has been exposed as little more than an unencrypted SD card behind a fingerprint-controlled power switch, prompting accusations of outright fraud rather than mere flawed implementation. Commenters use the case to highlight broader skepticism toward opaque “secure” hardware—from fingerprint sticks to self-encrypting drives and BitLocker key escrow—and argue that auditable, software-based encryption (often combined with secure elements) is generally more trustworthy. The incident also revives concerns about Lenovo’s past security practices and illustrates how many enterprise and regulatory security products exist mainly to tick compliance boxes rather than provide real protection.

Nature of the Lenovo “Encrypted” USB Issue

  • The “encrypted” fingerprint USB turns out to be a case with a plain SD card inside; the fingerprint module just gates USB power/connection, no encryption on data.
  • Some note it’s worse than a flawed crypto implementation because it’s effectively no security while being marketed as secure.
  • Timeline mentioned: product announced around 2019, flaw found in 2025, CVE issued 2025, public talk in 2026.
  • Several commenters see this as fraud rather than a mere bug; others allow for incompetence plus a box‑ticking culture.

Trust in Hardware-Encrypted Devices

  • Many distrust hardware-encrypted USB drives and prefer software solutions (VeraCrypt, LUKS, BitLocker) on commodity media.
  • Hardware devices are seen as:
    • Opaque and hard to audit.
    • Often poorly implemented (backdoors, weak randomness, hardcoded keys).
    • A single point of failure (if controller fails, data is lost).
  • Some argue hardware + secure elements can be stronger for brute-force resistance and usability (short PINs, biometrics, lockouts), especially for non‑experts.
  • Others stress that “implemented correctly” is a huge and rarely met requirement.

Biometrics and Fingerprint Drives

  • Fingerprint-secured USB is criticized:
    • Attacker likely has both the device and a fingerprint sample on it.
    • Biometric sensors and controllers are typically non‑auditable black boxes.
  • Better patterns suggested: software crypto with keys stored in a small hardware security module (TPM, secure enclave, FIDO/YubiKey) rather than in the drive itself.

Enterprise, Compliance, and Use Cases

  • In regulated/government settings, such devices are often mandated to “check compliance boxes,” not necessarily to provide robust security.
  • Some organizations use keypad/whitelisted USB products to simplify policy enforcement and disaster recovery, while still preferring software FDE for everyday use.

Lenovo and Vendor Trust

  • Past Lenovo security incidents (e.g., preinstalled malware, hardcoded credentials) are cited as reasons to distrust them for security products.
  • Broader sentiment: no PC vendor’s hardware can be fully trusted; at best, users minimize trust and rely on open, verifiable software crypto.

Legal, Ethical, and Market Concerns

  • Multiple commenters ask why such misleading marketing isn’t illegal and doubt Lenovo will face consequences.
  • Some note the product appears mainly sold in China, speculating that region-targeted misrepresentation is easier.

Meta Discussion

  • Side threads touch on AI-assisted reverse engineering, AI‑like writing patterns (semicolons in subheadings), and frustration with Reddit links vs direct sources.