1 / 5
overview-advice
Basics:
What extra protection does hardware encryption add?
A system password is a software program like any other, so a determined thief can remove the hard drive from your computer, attach it to another machine, and crack the password. But these drives won't even mount on a PC desktop unless you first pass a hardware-based authentication test: typing a PIN on a keypad, swiping a fingerprint, tapping an RFID badge, or entering a code displayed on a separate dongle. Fail the hardware tests and the drive locks up. Even if somebody cracks open the case and removes the drive, there's still a 128- or 256-bit military-grade encryption algorithm built into the firmware, so your data is run through a digital Cuisinart before it's even written to the disk, rendering it unreadable. So they're uncrackable?
No. No encryption is. But if you store your sensitive info on one of these drives, there's a very good chance nobody will ever see it without your say-so. Brazilian and FBI codebreakers spent two years trying to decipher data on the hardware-secured drives of a Brazilian banker suspected of money laundering—before giving up in 2010. What if I lose my passcode?
All these drives have an admin mode; admins can create codes for up to 10 or so users and can reset a forgotten code. If you're not the admin, the "forgot my passcode" drill is somewhat forgiving. You get up to 25 attempts, after which the drive will require a factory-programmed fail-safe code to enable more PIN entries. After 50 or so failed attempts, the drive assumes it's under attack and self-destructs. Buying Advice These drives cost two to five times as much as unprotected drives -- if you just want to stash your Beatles MP3s, look elsewhere. Chip-based 256-bit encryption and security features like automatic self-destruct are the norm, so all these drives offer the same base level of protection. Your decision should come down to transfer speed, keypad usability, and, if your data is top-secret, the inclusion of secondary authenticators like smartcards and RFID readers.
A system password is a software program like any other, so a determined thief can remove the hard drive from your computer, attach it to another machine, and crack the password. But these drives won't even mount on a PC desktop unless you first pass a hardware-based authentication test: typing a PIN on a keypad, swiping a fingerprint, tapping an RFID badge, or entering a code displayed on a separate dongle. Fail the hardware tests and the drive locks up. Even if somebody cracks open the case and removes the drive, there's still a 128- or 256-bit military-grade encryption algorithm built into the firmware, so your data is run through a digital Cuisinart before it's even written to the disk, rendering it unreadable. So they're uncrackable?
No. No encryption is. But if you store your sensitive info on one of these drives, there's a very good chance nobody will ever see it without your say-so. Brazilian and FBI codebreakers spent two years trying to decipher data on the hardware-secured drives of a Brazilian banker suspected of money laundering—before giving up in 2010. What if I lose my passcode?
All these drives have an admin mode; admins can create codes for up to 10 or so users and can reset a forgotten code. If you're not the admin, the "forgot my passcode" drill is somewhat forgiving. You get up to 25 attempts, after which the drive will require a factory-programmed fail-safe code to enable more PIN entries. After 50 or so failed attempts, the drive assumes it's under attack and self-destructs. Buying Advice These drives cost two to five times as much as unprotected drives -- if you just want to stash your Beatles MP3s, look elsewhere. Chip-based 256-bit encryption and security features like automatic self-destruct are the norm, so all these drives offer the same base level of protection. Your decision should come down to transfer speed, keypad usability, and, if your data is top-secret, the inclusion of secondary authenticators like smartcards and RFID readers.
Photos by Greg Broom/Wired
