Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

File Vault and Password selection

Alpha Centauri

Alpha Centauri

macrumors 68000
Original poster
Oct 13, 2020
1,517
1,183
Hi all

been meaning to ask but keep forgetting.

Few months ago I purchased an M2 MBP (Ventura) to replace my mid 2009er that ran a patched OS.

During set up of the M2 I turned on File Vault and I used the same user password as I do with unlocking the Mac. This got me wondering, with using exactly the same password, what the point of encrypting the disk actually was?

Are folks choosing a different password and must then enter both separately to gain access? I've read some documentation on this but the more I read, the further I get away from this likely basic question.

Cheers
 
scouser75 said:
I turned on fire vault at setup stage too but wasnt asked for a password 🤔
Click to expand...
Tbh I cannot recall to 100%. In Privacy&Security>File Vault it does say that a recovery key has been set. I believe that this key I chose was likely the one I use to log in to user. In this scenario I guess there was little point in enabling FV?

So had I set an entirely different name as a recovery password, would I'd end up having to log in twice? Once as a user, and once to decrypt?
 
Alpha Centauri said:
Hi all

been meaning to ask but keep forgetting.

Few months ago I purchased an M2 MBP (Ventura) to replace my mid 2009er that ran a patched OS.

During set up of the M2 I turned on File Vault and I used the same user password as I do with unlocking the Mac. This got me wondering, with using exactly the same password, what the point of encrypting the disk actually was?

Are folks choosing a different password and must then enter both separately to gain access? I've read some documentation on this but the more I read, the further I get away from this likely basic question.

Cheers
Click to expand...

I have often wondered the same, and seen the article linked by @chabig. I think the justication boils down to making the drive unreadable if it is removed from the Mac or if the Mac is booted from an external.

I have my boot drives FileVaulted, and externals encrypted because of the overwhelming advice that we should!
 
Mike Boreham said:
I have often wondered the same, and seen the article linked by @chabig. I think the justication boils down to making the drive unreadable if it is removed from the Mac or if the Mac is booted from an external.

I have my boot drives FileVaulted, and externals encrypted because of the overwhelming advice that we should!
Click to expand...
So in a way this seems to more so be useful (on silicon Macs) if one forgets the user password of the internal boot volume or a hardware encryption key is used?

I understand the logic of using FV on easily removable internal drives, also password protection of externals but:

Let's say in case of theft, having the user password set the same (in my case) as the recovery password, seems rather pointless. Had I set up with a hardware based recovery key+password, I see value in FV.

I'm sure this is such a basic question that it will just "click" when I understand the scenarios of its use.
 
I hope there are some other responses. As I said, I do it more as an act of faith than from any conviction.

I think you would find that setting different keys for the user and FV is problematical, both to implement and in daily use.
 
chabig said:
It’s foolish not to enable FileVault. Everything you want to know:

eclecticlight.co

Why you should enable FileVault

T2 and Apple silicon Macs always encrypt the Data volume in internal storage. So why bother with enabling FileVault? And can you do that on external bootable disks?
eclecticlight.co eclecticlight.co
Click to expand...
thank you for that link. I think I set FV up without giving it too much thought. I did never have it active on my patched 5.3 MBP due to slowness but that's not an issue anymore on the M2.

Let's say I chose to enable FV again but this time with a hardware encryption key, is it basic to turn FV off again without any data loss? With my current set up I chose the recovery key to be identical to my user password. For some reason I believed that using a different password, I would then have to log in twice.
 
Mike Boreham said:
I hope there are some other responses. As I said, I do it more as an act of faith than from any conviction.

I think you would find that setting different keys for the user and FV is problematical, both to implement and in daily use.
Click to expand...
Yes, that's why I used the same passwords, thinking I'd have to otherwise log in twice in daily use. I think my whole thinking is upside down on this basic concept. Using the same password I thought, the OS would recognize it as such and just a user log in be adequate. But on reflection doing this appears (to me) self defeating.
 
Mike Boreham said:
If you turn on FV on the booted volume (the only way to do it) you will be set up with the same password ...there is no option to set a separate one, though there are ways of doing it.
Click to expand...
thank you. I could have sworn when the options come up for using a hardware key, that I chose my password as an encryption key. But knowing my memory declining, I wouldn't want to bet my life on it.
 
Alpha Centauri said:
thank you. I could have sworn when the options come up for using a hardware key, that I chose my password as an encryption key. But knowing my memory declining, I wouldn't want to bet my life on it.
Click to expand...
The choice you get is how you want to recover your FileVaulted drive should you forget the daily unlock one (same as the user). You can chose to either recover with your Apple ID or a standalone Recovery key.

Screenshot 2023-06-22 at 12.29.52.png
 
  • Like
Reactions: kitKAC, gilby101 and scouser75
Thanks guys for the useful info.

I just checked my FW within settings and it mentions nothing about a separate password or anything to do with passwords.

The only option I have is to turn FW off. And Warning blurb about needing your login password or key etc

Does this sound right?
 
scouser75 said:
Thanks guys for the useful info.

I just checked my FW within settings and it mentions nothing about a separate password or anything to do with passwords.

The only option I have is to turn FW off. And Warning blurb about needing your login password or key etc

Does this sound right?
Click to expand...
Yep.
 
It’s not very complicated. On AS and T2 Macs, everything on the SSD is hardware encrypted with a volume encryption key, stored in the Secure Enclave. FileVault protects the volume encryption key with your user password, so nothing can be decrypted without the user password.

It’s all explained very well in the Eclectic Light article I linked in post 4.
 
  • Like
Reactions: NoBoMac and scouser75
chabig said:
It’s foolish not to enable FileVault.
Click to expand...

It introduces another possible point of failure, if even on the human end. No reason to use if you feel that your system is secure, such as a desktop in a fixed secure environment, if you don't care if someone can see the disk contents, etc. With a moveable laptop that's another issue.
 
  • Like
Reactions: scouser75
HDFan said:
It introduces another possible point of failure, if even on the human end. No reason to use if you feel that your system is secure, such as a desktop in a fixed secure environment, if you don't care if someone can see the disk contents, etc. With a moveable laptop that's another issue.
Click to expand...

As @chabig says, there is not much scope for human error if you do it the default Apple way. I agree if you go to the complexity of creating a different FV and User passwords there is definitely scope.
 
Mike Boreham said:
As @chabig says, there is not much scope for human error if you do it the default Apple way. I agree if you go to the complexity of creating a different FV and User passwords there is definitely scope.
Click to expand...

How do you create different FV and user passwords?
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back