Phantomdrive Open-Source USB Drive Conceals Encrypted Storage to Resist Coercion
Developer Ryan Walker has created Phantomdrive, an open-source USB storage device designed to protect users against forced decryption demands in jurisdictions with weak privacy laws. Unlike standard hidden-volume solutions such as VeraCrypt, Phantomdrive aims to prevent authorities from even detecting the existence of additional encrypted space.
The device presents itself to the host operating system as a conventional 8 GB drive upon first connection. Any data written to this visible area remains unencrypted until the user creates a text file containing the exact string password: PUTYOURPASSWORDHERE. The firmware then triggers a re-enumeration that exposes the hidden, AES-encrypted partition while simultaneously encrypting the previously visible area on the fly.
Hardware design centers on the CH569 microcontroller from the same family as the widely used CH340 USB-to-serial bridge. The chip provides native USB 3.0, SD/eMMC interfacing, and a hardware encryption block supporting the Chinese SM4 algorithm alongside standard AES operations. Storage is provided by an SD card rather than eMMC due to current pricing pressures; the entire assembly is sealed with epoxy resin so that physical access requires destruction of the enclosure.
Key derivation uses a per-device salt extracted from the USB serial number (for example, Phantomdrive:34FC1FA7145467F7) combined with 100,000 iterations of SHA-256. This approach eliminates rainbow-table attacks across multiple devices and raises the cost of brute-force attempts. The developer deliberately avoided memory-hard functions such as Argon2 because the limited RAM on the CH569 would make unlock times exceed acceptable limits.
Encryption defaults to AES-CTR mode, achieving approximately 9 MB/s write and 20 MB/s read throughput. AES-XTS is also implemented for users who prioritize resistance to ciphertext manipulation over speed, although it reduces performance to roughly 6 MB/s writes and 10 MB/s reads. Both modes were validated through functional tests and cross-checked against the OpenSSL reference implementation.
The firmware continuously inspects raw USB WRITE10 commands for the trigger string without interpreting any file system. When detected, the password is copied into RAM, the buffer is zeroed to prevent the secret from reaching the media, and the device switches partitions. Users are warned that high volumes of random data on the visible partition could theoretically produce a false-positive match.
All schematics, firmware sources, and mechanical files are released publicly, along with the supporting libraries originally developed for the hydrausb3 project. Pre-order pages are already live for those wishing to obtain early hardware units.
Related articles
Review of GL.iNet Mudi 7 and Xray Configuration for Flexible Traffic Routing
The article provides a hands-on review of the GL.iNet Mudi 7 portable router combined with detailed instructions for deploying Xray. The author explains moving away from managing multiple separate VPN clients by installing Xray directly on the router. This setup allows all connected devices to route traffic intelligently without manual configuration on each endpoint. Local and Russian services connect directly to avoid latency, while international traffic is forwarded through a personal server. The guide covers practical scenarios for home use and emphasizes maintaining speed for permitted connections while ensuring selective proxying for the rest of the traffic.
Taiwan Man Uses Robot Vacuum Camera to Prove Wife's Affair, Wins Compensation but Receives Prison Sentence for Illegal Recording
A resident of Taiwan suspected his wife of infidelity after discovering a stranger's toothbrush in their countryside home. He reviewed footage from a parking lot camera and later accessed the live feed of their robot vacuum cleaner through its mobile application, capturing intimate recordings without consent. The man preserved the video evidence and successfully sued for breach of marital rights, receiving approximately $19,000 in compensation. His wife filed a counterclaim, arguing that the recordings violated her right to privacy because the device's sensors and indicators did not clearly indicate active surveillance. Although the footage was accepted in the civil case, the court ruled that the illegal method of obtaining it outweighed marital obligations, prioritizing personal privacy protections. The husband was sentenced to five months in prison and fined 150,000 Taiwanese dollars, representing 30 percent of his awarded compensation.
Russian Firms Accumulate Digital Clutter: 35% of Corporate Files Unused for Years, Weak Passwords Expose Sensitive Data
A study by Russian cybersecurity firm Garda examined more than 157 terabytes of data and over 511,000 user accounts across more than 100 companies. Researchers found that approximately 35% of files in corporate repositories had not been accessed for more than five years, while duplicate data could occupy another 35% of storage volume. In several industries, up to one-third of stored content consisted of personal photographs, videos, and archives unrelated to business operations. More than 33% of accounts used critically weak passwords or credentials that had not been changed for extended periods, and numerous contractor and temporary employee accounts remained active despite being unused for over 90 days. Direct access permissions bypassing security groups were widespread, allowing broad access to folders containing passport scans, client registries, and database exports. Garda recommends automated inventory, classification, centralized access management, and lifecycle automation to reduce risks instead of manual cleanup.
Apple Updates Private Relay Domain for Sign in with Apple: Why Email Cannot Serve as Account Identity
Apple announced that new Private Relay addresses for Sign in with Apple will use the private.icloud.com domain starting later in 2026, while existing privaterelay.appleid.com addresses will continue functioning without interruption. The change highlights a deeper architectural issue: many applications incorrectly treat email addresses returned by Apple as stable identifiers rather than transient contact channels. Proper implementation requires separating the signed identity token, the verified subject claim, and the optional email relay address into distinct data models. Developers must validate the full identity token on the server, including signature, issuer, audience, nonce, and expiration, before linking any Apple identity to an internal account. Using provider and subject pairs as the unique key prevents duplicate accounts, accidental merges, and broken logins when relay domains or email claims change. The article provides concrete recommendations for data models, token verification boundaries, and test cases that remain resilient to future Apple updates.