Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

How to encrypt your Mac with FileVault 2, and why you absolutely should

Glenn Fleishman | Feb. 6, 2015
Apple's first pass at built-in encryption was, frankly, terrible. The original FileVault, introduced with 10.3 Panther in 2003, only encrypted a user's home directory, and had a number of functional and implementation problems. FileVault 2 appeared in 2011 with 10.7 Lion, and had almost nothing to do with the original except the name.

Warning 2! Once you start the conversion, there's no stopping it. It has to complete, and it consumes CPU resources like mad, slowing down your machine and likely firing up the fan to high speed. Your computer also has to remain plugged in. The operation takes many hours. A friend's niece accidentally accepted the option to enable FileVault 2 when upgrading to Yosemite a few evenings ago, and had her machine — needed for a computer-science class the next morning — slow to a crawl.

Apple provides step-by-step details in a Knowledge Base note, so I won't repeat all of that, but will highlight the critical parts.

Only accounts enabled with FileVault 2 can unlock the volume at boot time after a cold start (when shut down) or restart. For accounts you don't opt to enable, restarting or starting up will require an account with permission logs in, then logs out. If you're helping set up FileVault 2 for a novice user who trusts you, you may ask them to create an account for you that would let you log in if they can't.

Accounts that use an iCloud password for login do provide a way out if you forget or lose an account password, but also offers a security risk if someone obtains your iCloud account information. (During a Yosemite upgrade, you can choose this explicitly when enabled FileVault 2 by checking a box that reads "Allow my iCloud account to unlock my disk." Oddly, Apple has no information about this option on its support site.)

The option to store your Recovery Key on Apple's servers is secure, in that Apple apparently can only unlock the key given information you provide, exactly as it's typed, including capitalization. It doesn't retain enough information to unlock it independently. However, it does put the key in the hands of a party other than yourself, making it possible under the right circumstances for a government agency or ne'er-do-wells to legally or socially engineer access to your recovery key.

Once the conversion is complete, the startup drive is fully protected within the limits of exposure I note above.

What's even niftier is that with Find My Mac enabled on the computer, you have a sort of secret weapon. Find My Mac works when the computer is booted and connected to a network. You can play a sound, lock the computer, locate it (if Wi-Fi networks or other cues to location are nearby), and erase it. Because FileVault 2 relies on a stored encryption key, erasing the drive wipes that key, rendering the drive unrecoverable, even by you.

But the extra-secret secret weapon is Guest mode. When a user logs in as a guest and connects to a network, or the Mac automatically connects to a known network, Find My Mac continues to work. Thus, if someone finds your computer, any message you send with the Lock option can appear, even if it was online before they log in as a guest. But so too can an Erase request make its way through silently.


Previous Page  1  2  3  Next Page 

Sign up for Computerworld eNewsletters.