> The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay,

- Have the first check be a simple 8bit hash that filters out most passwords in microseconds, or use a customizable prefix instead of “password:”.

- have your password checking thread run in background at idle priority

- when you get an async password match, force usb disconnect and reconnect and the system will rescan the bus and mount your real drive.

Short of adversary dumping drive firmware (or them figuring out your hn account t, having a LLM scan the messages and finding this conversation) it’s not really easily detectable..