Privacy
Lenovo's 'encrypted' fingerprint USB drive was just a plain SD card
A researcher found Lenovo's AES-256 fingerprint stick stored data unencrypted, and follow-up work surfaced backdoors and hardcoded keys in other 'secure' drives.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
Lenovo’s ‘AES-256 encrypted’ fingerprint USB stick was an unencrypted SD card
Security researcher Xusheng Li found that a Lenovo ThinkPlus FU100 fingerprint USB stick, marketed as an AES-256-encrypted device, was internally just a plain SD card: the fingerprint reader only enabled the USB connection and nothing on the card was encrypted. An AI-assisted follow-up found what Li calls backdoor accounts on another maker’s drive and hardcoded keys in other supposedly secure USB storage products. Lenovo said the referenced ThinkPlus products were designed for the China market and sold only in mainland China. After the vulnerabilities were reported in August 2025, Lenovo worked with the researcher through coordinated disclosure, remediated the issues via hardware and software upgrades, and published a security advisory and three CVEs in January 2026: CVE-2025-13453, CVE-2025-13454 and CVE-2025-13455. Affected customers can contact Lenovo Support for a replacement.
Users report OpenAI silently re-enabled model training on Codex chats
A user reported that the data-sharing setting in OpenAI’s Codex had been silently re-enabled for them and their coworkers, despite the group having previously disabled data sharing to avoid leaking intellectual property through prompts. None of them knowingly opted back in. The setting to check is Improve the model for everyone under ChatGPT’s data controls at chatgpt.com/settings/data-controls. The user asked whether the issue was isolated or more widespread and noted the behavior had been reported before on Hacker News. Data sharing can reportedly also be turned off through OpenAI’s privacy portal at privacy.openai.com. OpenAI has not publicly confirmed the reports or explained how the setting was changed.
OpenAI seems to be silently re-enabling model training on Codex chats →
Topics: OpenAI CodexOpenAI
Signal fork Molly hasn’t been updated in three months and misses fixed exploits
Molly, a Signal fork, has not been updated since version v8.19.2-4, released on 31 July, and contains vulnerabilities already fixed in mainline Signal. One example is the latest exploit disclosed in October, which has been fixed in Signal 8.27.1 while Molly remains vulnerable. Users are currently advised to use mainline Signal and delete Molly until it resumes adequate updates, if it ever does. The warning matters for people who chose the fork for extra hardening or Android-specific features: staying on an unmaintained client means missing patches for known attacks, and the gap widens with every upstream release.
Topics: Messaging apps privacy
Russia’s FSB to get round-the-clock crypto exchange customer data from March
Russia’s Federal Security Service will gain round-the-clock access to cryptocurrency exchange customers’ personal data starting in March 2027, per a Russian Central Bank document on the federal law On Digital Currencies and Digital Rights flagged by Sarkis Darbinyan of Roskomsvoboda. Market participants had proposed giving the FSB data only on request and barring access to private keys and transaction-signing tools through SORM; the Central Bank rejected this, saying the approach was agreed with the FSB. Exchanges will hand over full names, passport details, taxpayer identification numbers, phone numbers, emails, transactions, bank details, account numbers, wallet addresses, IP addresses, login times and platform correspondence. Darbinyan said implementing SORM will cost a hell of a lot of money, with no relief planned for small exchanges.
Topics: Crypto security
Always-on AI wearables push recording into everyday conversations
Amazon’s Bee subsidiary introduced the $75 Bee Frontier wristband, which uses two microphones to record meetings and conversations, with transcripts and summaries accessible on phones or computers; Amazon is also preparing a Bee phone accessory to track calls. The company says audio is processed in real time and immediately deleted, transcripts sit in an encrypted environment inaccessible to employees, and an LED lights whenever a device captures a conversation. Apple unveiled a Siri Recap feature for the latest Apple Watch models that summarizes conversations the watch listens in on. EPIC senior counsel Sara Geoghegan said LEDs are insufficient because bystanders may not recognize them, and California and Florida two-party consent laws make recording private conversations without consent illegal. Oxford professor Viktor Mayer-Schönberger warned that the ephemerality of public spaces has evaporated.
AI wearables want to remember everything. What happens when we can’t forget? →
Topics: Smart devices privacy