Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Alpha Centauri

macrumors 68000
Original poster
Oct 13, 2020
1,512
1,183
Hi all

been meaning to ask but keep forgetting.

Few months ago I purchased an M2 MBP (Ventura) to replace my mid 2009er that ran a patched OS.

During set up of the M2 I turned on File Vault and I used the same user password as I do with unlocking the Mac. This got me wondering, with using exactly the same password, what the point of encrypting the disk actually was?

Are folks choosing a different password and must then enter both separately to gain access? I've read some documentation on this but the more I read, the further I get away from this likely basic question.

Cheers
 
I turned on fire vault at setup stage too but wasnt asked for a password 🤔
Tbh I cannot recall to 100%. In Privacy&Security>File Vault it does say that a recovery key has been set. I believe that this key I chose was likely the one I use to log in to user. In this scenario I guess there was little point in enabling FV?

So had I set an entirely different name as a recovery password, would I'd end up having to log in twice? Once as a user, and once to decrypt?
 
Hi all

been meaning to ask but keep forgetting.

Few months ago I purchased an M2 MBP (Ventura) to replace my mid 2009er that ran a patched OS.

During set up of the M2 I turned on File Vault and I used the same user password as I do with unlocking the Mac. This got me wondering, with using exactly the same password, what the point of encrypting the disk actually was?

Are folks choosing a different password and must then enter both separately to gain access? I've read some documentation on this but the more I read, the further I get away from this likely basic question.

Cheers

I have often wondered the same, and seen the article linked by @chabig. I think the justication boils down to making the drive unreadable if it is removed from the Mac or if the Mac is booted from an external.

I have my boot drives FileVaulted, and externals encrypted because of the overwhelming advice that we should!
 
I have often wondered the same, and seen the article linked by @chabig. I think the justication boils down to making the drive unreadable if it is removed from the Mac or if the Mac is booted from an external.

I have my boot drives FileVaulted, and externals encrypted because of the overwhelming advice that we should!
So in a way this seems to more so be useful (on silicon Macs) if one forgets the user password of the internal boot volume or a hardware encryption key is used?

I understand the logic of using FV on easily removable internal drives, also password protection of externals but:

Let's say in case of theft, having the user password set the same (in my case) as the recovery password, seems rather pointless. Had I set up with a hardware based recovery key+password, I see value in FV.

I'm sure this is such a basic question that it will just "click" when I understand the scenarios of its use.
 
I hope there are some other responses. As I said, I do it more as an act of faith than from any conviction.

I think you would find that setting different keys for the user and FV is problematical, both to implement and in daily use.
 
It’s foolish not to enable FileVault. Everything you want to know:

thank you for that link. I think I set FV up without giving it too much thought. I did never have it active on my patched 5.3 MBP due to slowness but that's not an issue anymore on the M2.

Let's say I chose to enable FV again but this time with a hardware encryption key, is it basic to turn FV off again without any data loss? With my current set up I chose the recovery key to be identical to my user password. For some reason I believed that using a different password, I would then have to log in twice.
 
I hope there are some other responses. As I said, I do it more as an act of faith than from any conviction.

I think you would find that setting different keys for the user and FV is problematical, both to implement and in daily use.
Yes, that's why I used the same passwords, thinking I'd have to otherwise log in twice in daily use. I think my whole thinking is upside down on this basic concept. Using the same password I thought, the OS would recognize it as such and just a user log in be adequate. But on reflection doing this appears (to me) self defeating.
 
If you turn on FV on the booted volume (the only way to do it) you will be set up with the same password ...there is no option to set a separate one, though there are ways of doing it.
thank you. I could have sworn when the options come up for using a hardware key, that I chose my password as an encryption key. But knowing my memory declining, I wouldn't want to bet my life on it.
 
thank you. I could have sworn when the options come up for using a hardware key, that I chose my password as an encryption key. But knowing my memory declining, I wouldn't want to bet my life on it.
The choice you get is how you want to recover your FileVaulted drive should you forget the daily unlock one (same as the user). You can chose to either recover with your Apple ID or a standalone Recovery key.

Screenshot 2023-06-22 at 12.29.52.png
 
Thanks guys for the useful info.

I just checked my FW within settings and it mentions nothing about a separate password or anything to do with passwords.

The only option I have is to turn FW off. And Warning blurb about needing your login password or key etc

Does this sound right?
 
Thanks guys for the useful info.

I just checked my FW within settings and it mentions nothing about a separate password or anything to do with passwords.

The only option I have is to turn FW off. And Warning blurb about needing your login password or key etc

Does this sound right?
Yep.
 
It’s not very complicated. On AS and T2 Macs, everything on the SSD is hardware encrypted with a volume encryption key, stored in the Secure Enclave. FileVault protects the volume encryption key with your user password, so nothing can be decrypted without the user password.

It’s all explained very well in the Eclectic Light article I linked in post 4.
 
It’s foolish not to enable FileVault.

It introduces another possible point of failure, if even on the human end. No reason to use if you feel that your system is secure, such as a desktop in a fixed secure environment, if you don't care if someone can see the disk contents, etc. With a moveable laptop that's another issue.
 
  • Like
Reactions: scouser75
It introduces another possible point of failure, if even on the human end. No reason to use if you feel that your system is secure, such as a desktop in a fixed secure environment, if you don't care if someone can see the disk contents, etc. With a moveable laptop that's another issue.

As @chabig says, there is not much scope for human error if you do it the default Apple way. I agree if you go to the complexity of creating a different FV and User passwords there is definitely scope.
 
As @chabig says, there is not much scope for human error if you do it the default Apple way. I agree if you go to the complexity of creating a different FV and User passwords there is definitely scope.

How do you create different FV and user passwords?
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.