Is file vault really all that secure?

[Beaverman3001]

The FileVault master password is present to recover FileVault data if the user account password has been forgotten. The master password is not present just to reset the account password. The master password is used to reset the FileVault password, which is the same as the user password, in the event that the user password has been forgotten. http://docs.info.apple.com/article.html?path=Mac/10.4/en/mh1877.html

User passwords can be reset by an administrator or via the install disk if the only administrator has forgotten the password. http://support.apple.com/kb/HT1274

I stand corrected, thank you sir.

 

[neko girl]

The downside of not using full disk encryption is the swap files (includes hibernation image if battery drained during sleep) are not encrypted. But, users can encrypt the swap files by turning on "secure virtual memory" in the security pane of system preferences.

I think the biggest downside is not being able to do any type of differential backup, something that's essential for a cloud-based backup service. If the backup service has its own encryption, then the user could have his drive unencrypted while he uses it, and locked up when he's away.

I guess there's no good solution around yet, for Mac.

Time Machine just backs up the entire FileVault. This makes it worthless for what it is: stepping back through time to grab individual files.

 

[munkery]

I guess there's no good solution around yet, for Mac.

Put your security sensitive files in sparse bundle disk images made with disk utility and turn on secure virtual memory. This is adequate for most users and works great with Time Machine. If you keep the disk images unmounted as much as possible when you are logged in, it protects against cold boot attacks and remote attacks with user level access (both unlikely).

Time Machine just backs up the entire FileVault. This makes it worthless for what it is: stepping back through time to grab individual files.

Untrue. Time Machine makes incremental backups of the changes in the disk image of your home folder created by FileVault. But, it can only backup when logged out.

How does having encrypted cloud based backups protect the data existing on your computer if the computer is stolen? An attacker can still read the unencrypted data on your computer despite the encrypted backup. How do you secure your locally stored data?