227
It seems like the benefits are having the device lock/wipe itself after a set amount of attempts in case of a brute force attack and not having to run software to decrypt the drive on the device you plug it into.
I included a picture of the IronKey Keypad 200 but that's just because it's the first result that came up when I was looking for an example. There seem to be a few other manufacturers and models out there and they probably have different features.
I am curious what do you think of them? Do you think they are useful? Do you find it more a novelty?
It was an ExplainingComputers video titled Very Useful Small Computing Things that made me think of them.
Do encryption in software. History taught us hard lessons about this.
Can you think of some notable examples of hardware based encryption failing?
Besides the actual device dying I mean
https://m.youtube.com/watch?v=beMtNM7nwfQ&t=35m
Here is an alternative Piped link(s):
https://m.piped.video/watch?v=beMtNM7nwfQ
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
There's no password involved in that demo
That wasn't part of the assignment. ;)
The downside with doing encryption in software is that you can't limit attempts. If you are using a high-entropy key this is fine. But getting users to use high-entropy keys has problems. If there is an HSM integrated into the device you can limit the potential guesses before the key is wiped which is critical without high-entropy keys.
A blog I follow recently had a good post about this: https://words.filippo.io/dispatches/secure-elements/
Of course you are still better off with a high-entropy key and software. But if you trade off too much usability in the name of security you will likely find that your users/employees just work around the security.
Sure you can. Use a memory hard hashing algo
That mitigates the problem but doesn't solve it. If you want unlocking to be <1s and your adversary has 10k times the RAM and can take a month they can make 26 billion guesses. So unless your password is fairly high entropy it is at risk. Especially if they have more resources or more time. PINs are definitely out of the question, and simple passwords too.
Good passwords are important. Always.