Funny, a security-oriented product from a company that was caught red-handed preinstalling rootkits in their products some ten years ago. I grew up with IBM 380XD and ThinkPad was always a sign of high reliability (that machine still runs WinXP until today).
show comments
charles_f
I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer.
It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having anyone review the design and approve it. They must have known it was nothing they pretended and still decide to sell it.
show comments
InsidiousWombat
Normally I'd say 90% of "enterprise" hardware is same stuff consumers get but badly tested, with more bugs, and in enterprise(rack etc.) format but this is something else.
Getting chip with hardware AES isn't even hard and they implemented 90% of what is needed (usb-sd card protocol and accepting the key), it's just wtf. Maybe they prompted "make a storage driver accessing SD card after unlocking with AES key" ;) bot device looks old enough to not be made with AI help.
Probably just "the MCU that was fast enough wasn't cheap enough", but the fact process didn't caught it should basically remove Lenovo as serious vendor from anyone's consideration
Does anyone actually trust these products? Always seemed like a terrible idea to me. The correct solution is to use free software cryptography on top of these things.
show comments
aliasxneo
I can imagine some "Hollywood hacker" scene where the guy steals an encrypted USB and proceeds to break into it.
"How did you get the data?"
"It was just an unencrypted SD card inside"
Not very exciting, but I guess just as accurate as reality!
show comments
thayne
The name "FU100" makes this seem like it is a joke product, at the customers expense. Interestingly, I haven't been able to find a product listing for this except on chinese websites like Alibaba.
jagged-chisel
Why a link to Reddit instead of the link to Tom’s Hardware?
show comments
regus
After the Superfish scandal Lenovo went on my “never buy anything from this company” list.
show comments
forgotpwd16
Interesting those those news are quite late, probably because it (and the entire ThinkPlus USB lineup) wasn't available outside CN. The product was first announced 2019, the flaw was found Aug 2025, CVE-2025-13453 was issued early Jan, and Li's presentation was in Mar.
Retr0id
This should be illegal. And maybe it already is? What consequences will Lenovo face, if any?
show comments
beloch
A fingerprint encrypted USB drive is just a bad concept to begin with.
1. Anyone who has access to the drive likely also has a nice sample of your fingerprint on the same device.
2. Hardware encryption implementations are often unknown, flawed, or completely missing. You shouldn't place trust in obscurity.
3. Hardware encryption often adds an unnecessary point of failure. I've seen drives with hardware encryption implemented on a daughter board become unrecoverable because the daughter board failed, even though the drive itself was just fine.
Put a software encrypted volume on a normal storage device and call it a day. Don't pay extra to do worse.
EmX_3000
I always thought you should encrypt any really sensitive personal information any way you can, then if you store or send it later hopefully it's not compromised. Even when your storage media is supposedly secure. What's the harm in that, there are easy to use tools to help you along. Some professions, like with lawyers and accountants, you'd think they'd all do this as a matter of course but they don't. Big and small tech too. So why not encrypt all your personal data at the source, the home computer / personal compuer and just call it a day? Can you do that on your platform / tech stack?
nik282000
Marketing wank made to sell e-waste to middle management.
hosteur
So basically fraud? I’m sure the responsible people are getting fired and fined/jailed.
untessela
Can anyone find a product listing where this was actually for sale? I couldn't.
show comments
BatteryMountain
Seems like a high-school project or a counterfeit item? If not, Lenovo messed up badly.
jwr
I always said that in-device encryption that you cannot verify is useless and considered those SATA drives with built-in encryption to be useless. Famous HN luminaries disagreed with me.
show comments
angry_octet
This is a great survey of the internals of Ironkey devices:
I feel like there’s a mismatch between what this is designed for and what people are assuming it’s for (plus no doubt hyperbolic marketing). Clearly this was designed to keep your files from your roommate or kid’s prying eyes, and not to keep military secrets or your plans to overthrow the government.
How much hardware and even software that is supposedly used for encryption is actually backdoored?
We know that Microsoft's bitlocker had at least one backdoor. Lenovo's fingerprint USB also has backdoors.
It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt. Then again, who guarantees that the executables are actually build from the source? Or that the keys aren't somehow sent over to agencies by the operating system?
TLDR, we cannot realistically trust anything in this dictatorship of mass surveillance.
show comments
aftbit
Why would they do it this way? If they're going to add a custom controller on the outside, why not make it encrypt before writing to the SD card?
I turned an old android into a fingerprint USB and a fido2 in one shot.
The fingerprint USB is actually legit since it's backed by a closed bio metric on device.
dennysora-main
I don't know why, but I find it pretty funny.
throwaway27448
Surely this is straight fraud?
ctkhn
Didn't expect something this crazy but I will not trust stuff like this until I've seen a teardown. Imagine being the product manager who approved this shit
show comments
jqpabc123
Just buy a standard USB drive and encrypt it with Bitlocker. If you hate MS then use Veracrypt.
What am I missing here?
show comments
mytailorisrich
Well it's called FU after all...
harrysstone0
[flagged]
pardeeplogisch
[dead]
pardeeplogisch
[flagged]
dpacmittal
Just use veracrypt or ecrypt on any memory card. These devices don't deserve the premium they charge for on-device encryption which in this case is not even encyrypted
judge2020
Were semicolons in subheadings common before AI? This subheading of the TomsHardware article just seems very artificial:
> The fingerprint only switched the USB connection on; nothing on the card was encrypted.
Funny, a security-oriented product from a company that was caught red-handed preinstalling rootkits in their products some ten years ago. I grew up with IBM 380XD and ThinkPad was always a sign of high reliability (that machine still runs WinXP until today).
I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer.
It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having anyone review the design and approve it. They must have known it was nothing they pretended and still decide to sell it.
Normally I'd say 90% of "enterprise" hardware is same stuff consumers get but badly tested, with more bugs, and in enterprise(rack etc.) format but this is something else.
Getting chip with hardware AES isn't even hard and they implemented 90% of what is needed (usb-sd card protocol and accepting the key), it's just wtf. Maybe they prompted "make a storage driver accessing SD card after unlocking with AES key" ;) bot device looks old enough to not be made with AI help.
Probably just "the MCU that was fast enough wasn't cheap enough", but the fact process didn't caught it should basically remove Lenovo as serious vendor from anyone's consideration
Linked article: https://www.tomshardware.com/tech-industry/cyber-security/le...
Does anyone actually trust these products? Always seemed like a terrible idea to me. The correct solution is to use free software cryptography on top of these things.
I can imagine some "Hollywood hacker" scene where the guy steals an encrypted USB and proceeds to break into it.
"How did you get the data?"
"It was just an unencrypted SD card inside"
Not very exciting, but I guess just as accurate as reality!
The name "FU100" makes this seem like it is a joke product, at the customers expense. Interestingly, I haven't been able to find a product listing for this except on chinese websites like Alibaba.
Why a link to Reddit instead of the link to Tom’s Hardware?
After the Superfish scandal Lenovo went on my “never buy anything from this company” list.
Interesting those those news are quite late, probably because it (and the entire ThinkPlus USB lineup) wasn't available outside CN. The product was first announced 2019, the flaw was found Aug 2025, CVE-2025-13453 was issued early Jan, and Li's presentation was in Mar.
This should be illegal. And maybe it already is? What consequences will Lenovo face, if any?
A fingerprint encrypted USB drive is just a bad concept to begin with.
1. Anyone who has access to the drive likely also has a nice sample of your fingerprint on the same device.
2. Hardware encryption implementations are often unknown, flawed, or completely missing. You shouldn't place trust in obscurity.
3. Hardware encryption often adds an unnecessary point of failure. I've seen drives with hardware encryption implemented on a daughter board become unrecoverable because the daughter board failed, even though the drive itself was just fine.
Put a software encrypted volume on a normal storage device and call it a day. Don't pay extra to do worse.
I always thought you should encrypt any really sensitive personal information any way you can, then if you store or send it later hopefully it's not compromised. Even when your storage media is supposedly secure. What's the harm in that, there are easy to use tools to help you along. Some professions, like with lawyers and accountants, you'd think they'd all do this as a matter of course but they don't. Big and small tech too. So why not encrypt all your personal data at the source, the home computer / personal compuer and just call it a day? Can you do that on your platform / tech stack?
Marketing wank made to sell e-waste to middle management.
So basically fraud? I’m sure the responsible people are getting fired and fined/jailed.
Can anyone find a product listing where this was actually for sale? I couldn't.
Seems like a high-school project or a counterfeit item? If not, Lenovo messed up badly.
I always said that in-device encryption that you cannot verify is useless and considered those SATA drives with built-in encryption to be useless. Famous HN luminaries disagreed with me.
This is a great survey of the internals of Ironkey devices:
https://www.cl.cam.ac.uk/~sps32/IronKey_teardown.pdf
You shouldn't trust that these things are secure.
I feel like there’s a mismatch between what this is designed for and what people are assuming it’s for (plus no doubt hyperbolic marketing). Clearly this was designed to keep your files from your roommate or kid’s prying eyes, and not to keep military secrets or your plans to overthrow the government.
Why is it so hard to just make honest devices?
This could've been rendered relatively secure had the USB stick been potted, but I guess that would've cost an extra few cents. https://en.wikipedia.org/wiki/Potting_(electronics)
How much hardware and even software that is supposedly used for encryption is actually backdoored?
We know that Microsoft's bitlocker had at least one backdoor. Lenovo's fingerprint USB also has backdoors.
It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt. Then again, who guarantees that the executables are actually build from the source? Or that the keys aren't somehow sent over to agencies by the operating system?
TLDR, we cannot realistically trust anything in this dictatorship of mass surveillance.
Why would they do it this way? If they're going to add a custom controller on the outside, why not make it encrypt before writing to the SD card?
Lenovo the goat
Model name checks out (FU100)
https://github.com/hparadiz/nexus-6p-biokey
I turned an old android into a fingerprint USB and a fido2 in one shot.
The fingerprint USB is actually legit since it's backed by a closed bio metric on device.
I don't know why, but I find it pretty funny.
Surely this is straight fraud?
Didn't expect something this crazy but I will not trust stuff like this until I've seen a teardown. Imagine being the product manager who approved this shit
Just buy a standard USB drive and encrypt it with Bitlocker. If you hate MS then use Veracrypt.
What am I missing here?
Well it's called FU after all...
[flagged]
[dead]
[flagged]
Just use veracrypt or ecrypt on any memory card. These devices don't deserve the premium they charge for on-device encryption which in this case is not even encyrypted
Were semicolons in subheadings common before AI? This subheading of the TomsHardware article just seems very artificial:
> The fingerprint only switched the USB connection on; nothing on the card was encrypted.