As a community concerned with privacy and security, I wonder what your feelings are regarding the use of USB drive. I did some research and there seems to be open-source software allowing to encrypt the data on any usb drive, the first in the list being veracrypt.
On the opposite there is the option of buying some USB drive directly, like the Apricorn Aegis secure key, which offers encryption on the fly, but this is a much more expensive and perhaps a less secure alternative (I ask your opinion on this).
One last thing is that I plan to use multiple operating systems with this key (Windows, Macos, PureOS), so being Software-Free like the Apricorn might be an advantage.
I use a very broad approach here, really depending on what I need.
USB drives only used on one machine (e.g., backups):
I use LUKS to encrypt the whole drive. I have full system backups that way, but also three small 64GB keys (Amazon link here). For these keys my strategy is the following. They are used as backups for my most imported documents and my KeePassXC database. The drives are all LUKS encrypted and the documents are in addition inside a veracrypt encrypted storage file. All three sticks are redundant, are regularly backed up and stored in different locations (home, office, my bag). This way, even if my house, my backup, and my computer burns down, I have the most crucial things still available.
USB drives for various OSes:
As you already pointed out, this depends a lot on your budget. I use an Apricorn Aegis SecureKey for work. Justin Carroll wrote two in-depth review on the SecureKey (here) and on the Fortress secure SSD (here). I can highly recommend checking this out. I only have experience with the SecureKey. In summary, it’s an extremely handy device with some features that I especially like: the configurable brute-force protection and the self-destroy PIN. These devices are fairly pricey, but work very well on all operating systems and don’t require software.
If you would like to go the (much) cheaper, but less convenient way, consider encrypting your devices with veracrypt. You will need the software installed, but you will have excellent protection for your data.
Any disk drive using whatever storage technology must be viewed with suspicion in respect of the robustness of the encryption that it performs - because there is no way to audit whether it is actually secure.
There is no way to audit whether
its key generation is sufficiently random
its encryption algorithm is what it claims
it has a back door for the encryption key
it has a timing attack against the encryption key
it has any other unspecified bugs or back doors
etc.
It may also be difficult or impossible to update the drive’s firmware if any firmware defect does come to light - or simply because the encryption algorithm ceases to be adequate e.g. firmware update program only available in closed source and only for Microsoft Windows, or firmware update not available at all (drive is end-of-life for support).
As such, I believe that, in general, open source advocates would prefer to have encryption in the operating system software, where it can be audited and fixed, even if that leads to lower throughput.
Of course I don’t speak for all open source advocates. Just one of them.
I agree with @pfm about the utility and ease of use of the Apricorn Aegis. I use that drive and Datalocker DL2 drives at work. I can’t really recommend one over the other, as they are both very convenient and effective.
To address @kieran’s concern over auditing, I can say that both drives are US DoD approved for transport of highly-classified data. Not being a subject matter expert in DoD procurement regulations, but working in cybersecurity, I don’t know that the military audited these drives, but I think it is almost certain that they have. Of course, that doesn’t mean average folks like us can audit them and your trust factor in the US DoD may vary.
Having said that, they are not inexpensive and I don’t really have that kind of cash to burn. LUKS is good for me, but if you value, and can afford, convenience, they are both good options.
As far as I understand it, it seems like you still need to have the Nitrokey App installed in order to decrypt the storage, correct? In general this seems to be a very interesting project, a bit limited maybe for some users at the moment with 64GB max capacity. But the fact that it is completely open source and allows for actually checking the firmware after shipping is a big plus.
Yes, correct, here is Nitrokey download page or for PureOS # apt install nitrokey-app. Here is info about USB-Dongle Authentication. I’m not having one, yet. If you ask me it is somehow native to Librem line of products (not being expert). Still, at least one of key persons that work for Purism is expert on Nitrokey products.
Any drive manufacturer is free to open source their firmware etc. and thereby extend the auditability of the system. That is something that I would welcome.
In the specific drives that were mentioned initially, this raises some interesting additional questions.
Does the manufacturer allow the DoD (only) to review the source and verify that it is the source?
Does that make the manufacturer better or worse?
Are there two separate editions of the drive, the DoD edition and the pleb edition (where only the latter has the standard backdoors )?
I like what Nitrokey is doing. If auditability is the most important requirement then it seems the better option. On the other hand, the capacity is limited and the speed is only USB 2.0 (c.f. the Apricorn Aegis devices which are all, I think, USB 3.x - and quote actual read/write speeds).
I think I’ll wait until I receive the Librem 5 before moving on to my next imported gadget.
