if you have a bad password that's a user issue
Which doesn't do shit even if you're using argon with 32 GB memory usage or whatever. NSA is always going to be able to out-compute you. Not to mention you need a difficulty level that's usable for daily use, but the NSA can brute-force at their leisure, possibly decades in the future.
The "decades into the future" part is a much bigger threat than their ability to out-compute me in the short term.
Did we wake up in a world without key derivation functions to turn passwords/phrases into keys?
There was a great article around last week about PDFs using randomly generated keys that ended up using non-secure random number generators and the effect was the only unique portion of the key is was 9bits, and obviously forceable. I wouldn’t even describe this between burrito bites activity as “brute”.
The point being “AES” doesn’t mean secure. Secure through the whole implementation means secure. People fuck up crypto all day, calling out a specific cipher doesn’t mean much.
Well you can use open-source / free software cryptography to encrypt and decrypt using a secret key which you do not need to remember and which is safely stored behind a secure element.
And there are quite a few people doing just that.
It's immensely more secure than trusting Lenovo or Microsoft or whatever company.
And you can have your secret on the secure element protected by biometric auth too (some do offer just that).
And there are devices like that with a tiny attack surface that accept biometric (like your fingerprint) to unlock the secret.
To get the best of both world you trust the HSM with one thing: the secret, and that's it. And you use open-source software and protocols (like GPG and OpenSSH) with that secret.
My baseline assumption is that even the good commercial products are only secure from a non-determined attacker, not TLAs. Anything safe from TLAs is what’s being sold only to them.
The hardware is still a black box and you’ll never know how it behaves in conditions you didn't test against.
Because what I said above might sound like black magic to anyone who knows nothing about the topic I will expand.
The CPU on which the software runs gets far more scrutiny than the obscure encryption engine on the USB stick. And it's possible to validate the software encryption with minimal effort. Verify the output with various software implementations of the same algorithm, ran on different CPUs. They have to be compatible and can't all have the same bug or backdoor.
An encrypted stick is impossible to validate by the end user. They have no access to the CPU encryption engine or the raw storage so can't know the algorithm implementation, or the output to disk format which is probably proprietary.
I think you're overestimating how much backdoors there are in products vs actual bugs. As we've seen with with recent vulnerability disclosures, there's plenty of bugs that were put there unintentionally.
The point was that there are special products, implementations of already known algorithms, sold only to TLAs. They have the code validated to the Moon and back, unlike the commercial products.