Think that cool USB thumb drive you just bought with the word of ‘encryption’ written in big letters all over the package is really secure? Think again. ComputerWorld recently reviewed seven ‘secure’ USB drives and basically found that they are all crap. Either they have no security or all or they use AES in ECB mode (which is worthless) or they claim their security is ‘proprietary’ (i.e. snake oil).
Once again I have to ask how is the end user consumer supposed to know this? Why do we (consumers) have to wait for some third party to review a product before we know that the product will not do as it claims? When I go to the hardware store and buy a lamp I know it has been tested and meets certain requirements. I know that it won’t catch fire and burn down my house. Why can’t I have those same assurances when I buy a security product? I should be able to look at the product packaging and see that the product meets some sort of security standard or has been tested by some agency and meets certain criteria. If it can be done for electric pencil sharpeners it can be done for ‘secure’ USB thumb drives.
About Space Rogue
With over two decades of experience, Space Rogue (Cris Thomas) has testified before the U.S. Senate Committee on Homeland Security and Governmental Affairs, and has been interviewed by Wired, CNBC and even MTV. He created the wildly popular websites the Whacked Mac Archives and Cyber Squirrel 1. He produced the weekly podcast SpiderLabs Radio, and the critically acclaimed weekly news video program the Hacker News Network. His writing has appeared in Network Computing, New Statesman, The Hill, and the Christian Science Monitor. He has spoken at security conferences such as Def Con, Blackhat, and Shmoocon. Space Rogue currently works as the Global Lead of Policy and Special Initiatives for the legendary IBM X-Force.
More secure products that aren’t
Think that cool USB thumb drive you just bought with the word of ‘encryption’ written in big letters all over the package is really secure? Think again. ComputerWorld recently reviewed seven ‘secure’ USB drives and basically found that they are all crap. Either they have no security or all or they use AES in ECB mode (which is worthless) or they claim their security is ‘proprietary’ (i.e. snake oil).
Once again I have to ask how is the end user consumer supposed to know this? Why do we (consumers) have to wait for some third party to review a product before we know that the product will not do as it claims? When I go to the hardware store and buy a lamp I know it has been tested and meets certain requirements. I know that it won’t catch fire and burn down my house. Why can’t I have those same assurances when I buy a security product? I should be able to look at the product packaging and see that the product meets some sort of security standard or has been tested by some agency and meets certain criteria. If it can be done for electric pencil sharpeners it can be done for ‘secure’ USB thumb drives.
About Space Rogue
With over two decades of experience, Space Rogue (Cris Thomas) has testified before the U.S. Senate Committee on Homeland Security and Governmental Affairs, and has been interviewed by Wired, CNBC and even MTV. He created the wildly popular websites the Whacked Mac Archives and Cyber Squirrel 1. He produced the weekly podcast SpiderLabs Radio, and the critically acclaimed weekly news video program the Hacker News Network. His writing has appeared in Network Computing, New Statesman, The Hill, and the Christian Science Monitor. He has spoken at security conferences such as Def Con, Blackhat, and Shmoocon. Space Rogue currently works as the Global Lead of Policy and Special Initiatives for the legendary IBM X-Force.