0

I am looking for a hardware encrypted USB stick to carry some important files such as my KeePassXC database, Key files, cryptocurrency wallets, certificates and other stuff with me.

There are some promising products I've came across:

Kanguru Defender

Kingston DataTraveler 2000

Kingston Ironkey S1000

The Kingston DataTraveler uses a hardware keyboard to enter the passcode while the Kanguru products and also the Kingston Ironkey products use a software solution to enter the passcode, while the encryption is still happening on hardware side?

I'm wondering which solution might be the safest thing I can get? Since I assume with a software passcode input I'm not safe from keyloggers?

closed as off-topic by multithr3at3d, forest, Steffen Ullrich, schroeder Jul 25 '18 at 12:23

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

0

What is your threat model? A compromised machine? Do you have infinite budget for this?

If the question is if using a hardware keyboard is more secure than providing the password via software the answer is (usually) Yes. As you noted, a software pin would be vulnerable to a keylogger sniffing the drive password.

However, note that if you unlock this USB in an infected computer, it could as well make a copy of all the files in the usb drive instead of only the pin (or even better, wait until you unlock your Keepassxc database, then exfiltrate the decrypted contents from memory), so it's not too reassuring that a thief got all the protected contents, but was unable to steal the safe passcode, albeit technically you were slightly safer.

On the other hand, perhaps the only thing you care about is that your maid is not a spy which modifies the designs of the new nuclear power plant so it blows up, in which case entering a pin in a hardware keyboard to get read-only access would protect you.

Another point which may compare against the hardware keyboard is the social context in which you will unblock the drive. If you will have to unblock the drive in front of others, how easy will it be to conceal the passcode from them? A good typer can often input in the computer keyboard a long password well-known to him quick enough that other people will probably not obtain it. Whereas a short pincode could be noticed more easily (but perhaps you could unlock it when hidden behind the computer with the excuse of connecting it to a rear port).

You mention that you will (always?) carry that usb with you. While not related at all to its security, you may be interested in how comfortable would be to carry each of them, as the hardware keyboard necessarily results in a bigger stick.

Discretion may be another factor you may be interested in, as a usb stick with a hardware keyboard really stands out.

Or quite the opposite. You goal to get an encrypted usb may be to impress other people (eg. some prospective investors on your company) showing how secure you handle everything, so it must have an external keyboard but also a biometric reader, but it doesn't matter if it's unreliable and they actually allow anyone.

All of this without taking into account the actual security of the encryption itself (Is the drive lying and storing the files unencrypted? Is the algorithm of drive A better than the one of drive B? Are they even implemented properly?). I would recommend having an extra layer of software encryption to counter that (eg. the KeePassXC file in the drive is additionally encrypted, as probably are those certificates).

As the main risk to an encrypted usb drive is unlocking it on an untrusted computer, an alternative to storing your files on an encrypted usb would be to use a small smartphone —completely disconnected— dedicated exclusively to save your passwords and other files (setup disk encryption and all other perks). Being a separate device, you can retrieve the password there and then type it into the not-so-trusted computer for actual use, without fear of compromising the rest of passwords stored there.

Not the answer you're looking for? Browse other questions tagged or ask your own question.