Slashdot Mirror
Encrypted USB Key With TOR, Firefox
An anonymous reader writes "Gizmodo has a writeup on the new IronKey — a self-destructing, hardware-encrypted and -authenticated USB flash drive with on-board secure Firefox, high-speed TOR network, password manager, and online encrypted backup. Here is the demo page. $79 for a 1GB, $149 for 4GB." Ironkey works on XP and Vista only. Let's hope its self-destruct feature works better than Secustick's.
If you don't trust the host machine, it can log the password, read/alter your data after the valid password is entered and even maliciously destroy your data by simulating 11 wrong authentication attempts. If you do trust the host, there is little point in hardware encryption/authentication. And if your flash drive is physically stolen, it's enough to have plain software file encryption. Sounds like a solution in search of users who misunderstand the problem.
Who modded this funny? It's actually very sound advice.
I hadn't known there were so many idiots in the world until I started using the Internet -Stanislaw Lem
The simple answer is that Linux already has far better security tools that a novelty like this can never match.
While you're decrypting your Sup3rs3kr3t w4r3z on the usb key, any malware* you haven't found yet is potentially logging every keystroke. You need to choose windows, or security; you really can't have both.
P owered+Keylogger
[*] - http://www.emsisoft.com/en/malware/?Adware.Win32.
boycott slashdot February 10th - 17th check out: altSlashdot.org
Why would anyone suspicious of destructive countermeasures try the password even once? They'd know the chances of guessing the password are infinitesimal, and the risk of losing data high. Such an adversary would move directly to alternative methods, and again, it doesn't matter if it would take 10 tries or one try to wipe the drive.
A keystroke logger in the host OS or hardware could still be catching your passphrase.
Give me Classic Slashdot or give me death!
In all reality you wouldn't plug it in, you'd take the thing apart and dissolve the black goo. Then you would proceed with a hardware attack, reading the contents of the flash memory out and then attempt to crack the memory file.
Only if the attacker doesn't know what the memory stick is will it be able to erase itself.
Better not to have the blueprints than let the enemy have them.
Is that code for "keeping your wife out of your porn collection"?
What?
What if the computer has a keylogger and it logs the password that unlocks your data? Am I missing something?