FileVault

If your computer is on and you are logged in, your HD is not totally secure via FileVault 2.

One of the members here pointed the following out to me, and I have implemented it into my usage.

Open up Terminal and input ...

sudo pmset -a destroyfvkeyonstandby 1

Now go to Preferences > Screen Saver > Hot Corner > Pick a corner from the options and you have several options from the drop down menu. I chose put display to sleep. Still under Preferences > Security and Privacy > General > make sure require password after sleep or screen saver is set to immediately.

Once that is done, and you activate the hot corner you made by moving the cursor to that particular corner when you are stepping away from the computer, the FileVault password is removed from RAM and will have to be entered (again) to gain access to the computer.

You can revert back to system default anytime by replacing the 1 with a 0

sudo pmset -a destroyfvkeyonstandby 0

 

How does this affect backup strategies?

Will tome capsule create an encrypted or non encrypted copy?

I think of setting this up, but need to have a non encrypted copy somewhere.

 

For additional security, this should also be paired with setting hibernatemode to 25 rather than 3, like so.

sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25

Hibernatemode's default setting is 3, which means it will save the contents of RAM to the disk, but will leave the memory powered. When set to 25, hibernatemode will still save the contents of RAM to the disk, but will remove power to RAM. Powering down the memory modules is a slightly safer approach than just destroying the keys alone.