Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Should I turn on Firmware Password the moment I receive my 2018 MBP?

M.Rizk

M.Rizk

macrumors 6502a
Original poster
Apr 20, 2015
785
615
I’ve seen a few posts here in the past 2 months complaining about wiping and re-installing macOS on the new 2018 MBPs as the T2 chip asks them for the password for the admin user which is no longer there once the hard drive is wiped.

I read a few replies on previous topics that if a Firmware Password is set, the T2 will never ask for the admin user password and will always ask for the firmware password regardless of the current Mac status.

As a user who does a lot of advanced stuff and could brick the macOS, should I set a firmware password before I even start the initial setup on my MBP?

What happens if I forgot it? (won’t happen, but just in case it does)
 
M.Rizk said:
What happens if I forgot it? (won’t happen, but just in case it does)
Click to expand...
Many people have set the firmware password in the past and basically a door stop after that since they could use the laptop. I believe if you have proof of ownership, Apple has tools to unlock it, otherwise there's no way into the laptop.
 
  • Like
Reactions: afir93 and SDColorado
maflynn said:
Many people have set the firmware password in the past and basically a door stop after that since they could use the laptop. I believe if you have proof of ownership, Apple has tools to unlock it, otherwise there's no way into the laptop.
Click to expand...
I don’t understand this sentence. Are you saying the laptop becomes a doorstop after you set a firmware password if you forget the password?
 
unobtainium said:
I don’t understand this sentence. Are you saying the laptop becomes a doorstop after you set a firmware password if you forget the password?
Click to expand...

I’ve spoken with Apple Support about this. You will still be able to boot into your macOS and update it but if something wrong ever happens, forget being able to re-install macOS or wiping your HDD or booting from another volume/partition.

Sounds really dumb as they could have made it like activation lock with iCloud being able to unlock it but it seems like they stopped innovating there.
 
unobtainium said:
I don’t understand this sentence. Are you saying the laptop becomes a doorstop after you set a firmware password if you forget the password?
Click to expand...
You forget your password, then the only use for it is a door stop, because you'll not able to use it
 
  • Like
Reactions: jerryk
So it sounds like if you ever want to do a clean reinstall, the best bet is to disable absolutely all security options first.
 
unobtainium said:
So it sounds like if you ever want to do a clean reinstall, the best bet is to disable absolutely all security options first.
Click to expand...

Or enable Firmware Password and never forget it if you don’t want to lose the security features.
 
A password used very infrequently like this is just one of many good examples for using a password manager. Forgetting it shouldn’t even be a consideration.

People should absolutely turn on the firmware password.
 
M.Rizk said:
What happens if I forgot it? (won’t happen, but just in case it does)
Click to expand...
You would still be able to continue using the Mac, but it would not let you boot from anything other than the current internal drive that is set as the startup disk. If you take it to Apple with proof of ownership they can reset it for you.

I always set a firmware password and turn on FileVault right out of the box. Other than the mentioned risk of losing the password and locking yourself out, there is no reason not to turn it on.
 
  • Like
Reactions: oneMadRssn
Sackofnickels said:
Pardon my ignorance, but what is the benefit of a firmware password?
Click to expand...
It stops someone from booting your Mac to any drive other than the current drive set in the Startup Disk panel. So if someone steals your Mac and tries to boot to recovery or another drive to hack or reset your Mac, they will be unable to do so.

If you have the firmware password and FileVault both turned on, the thief has essentially stolen a MacBook that is worthless to them.
 
  • Like
Reactions: ignatius345 and M.Rizk
Thought so. I value my data privacy, so have Filevault enabled (late 2013 Macbook Retina), but don't want the hassle of a Firmware password (things like resetting PRAM are irritating with this enabled) so don't have that enabled.

If someone steals my laptop and the firmware password is enabled, they'll end up binning it and stealing another one. So, in fact, I'm taking one for the team and doing you all a favour by making mine usable once stolen :)
 
adrianlondon said:
Thought so. I value my data privacy, so have Filevault enabled (late 2013 Macbook Retina), but don't want the hassle of a Firmware password (things like resetting PRAM are irritating with this enabled) so don't have that enabled.

If someone steals my laptop and the firmware password is enabled, they'll end up binning it and stealing another one. So, in fact, I'm taking one for the team and doing you all a favour by making mine usable once stolen :)
Click to expand...

Having a firmware password on won't stop him from using it. He can still sell it because no one will check if a firmware password is there :D
 
  • Like
Reactions: adrianlondon
Weaselboy said:
It stops someone from booting your Mac to any drive other than the current drive set in the Startup Disk panel. So if someone steals your Mac and tries to boot to recovery or another drive to hack or reset your Mac, they will be unable to do so.

If you have the firmware password and FileVault both turned on, the thief has essentially stolen a MacBook that is worthless to them.
Click to expand...
But a thief won’t know that and you still won’t have your laptop. I doubt you’d get it back. Your still minus your laptop.
 
Big Ron said:
But a thief won’t know that and you still won’t have your laptop. I doubt you’d get it back. Your still minus your laptop.
Click to expand...
I agree it won't help get my laptop back, but I get some small satisfaction knowing the thief will get zero use out of it. :mad:

Once enabled, the FW password is transparent as far as day to day computer usage, so I see no reason not to use it.
 
Lennyvalentin said:
Question: how does one enable firmware password, or tell whether it is on or off?

Thanks! :)
Click to expand...
https://support.apple.com/en-us/HT204455

This link will walk you through it.

A quick way to tell though is to hold down the option key at boot. If there is no FW password set, the boot selector screen will come up. If there is one set, you will get a grey box asking for the FW password.
 
Weaselboy, some of what you posted above seems contradictory. Please clarify.

IF one sets a firmware password, the Mac becomes "unbootable" until the password is entered.
Is that a correct assumption?

If that's the case, if one forgets one's own firmware password, can you still "boot and run" from the internal drive? Or... no?

Why I asked:
Someone posed the question, to wit, if one forgets the firmware password, does the Mac end up the equivalent of a doorstop?
Without the password, would not the answer be... "yes"?
 
Fishrrman said:
IF one sets a firmware password, the Mac becomes "unbootable" until the password is entered.
Is that a correct assumption?
Click to expand...
No.... that is not correct. All the FW password does is prevent the Mac from booting from anything other than the drive selected in the System Prefs Startup Disk pane. Normally, that would be set to the internal drive. So even with a FW password set, the system will boot right up to the internal drive and ask you for a login password.
 
"All the FW password does is prevent the Mac from booting from anything other than the drive selected in the System Prefs Startup Disk pane."

OK, thanks for the clarification.

I've never used the firmware password option -- and never will.

I WANT my Macs to be "easy to get to".
But... that's just me.
 
  • Like
Reactions: ignatius345
Fishrrman said:
"All the FW password does is prevent the Mac from booting from anything other than the drive selected in the System Prefs Startup Disk pane."

OK, thanks for the clarification.

I've never used the firmware password option -- and never will.

I WANT my Macs to be "easy to get to".
But... that's just me.
Click to expand...

Firmware Password seems to be a recommended step in T2 machines because T2 sometimes asks for the password of the macOS admin user to let you install another OS (or replace the current).

If your current macOS is corrupted you might get stuck and never be able to boot again till you send it to Apple.

I really recommend enabling it, or else disable all the T2 security features to not regret it later.
 
  • Like
Reactions: Calebtt
It is a very good and wonderful thing the firmware password on paper..and in securing us all from those nasty thieves HOWEVER it is also the bringer of nightmares if you EVER find yourself locked out of your computer AND need urgently to use a keypad combination to access any of the safety nets Apple have put in place to help your computer.
Things like Recovery Mode , Single user Mode ,Verbose Mode , Network mode etc etc these are vital hidden tools that you WILL need one day , trust me ! And if your Mac is firmware locked you can say goodbye to the instant quick fixes these combinations can achieve for you ! My advice is let Apple take care of the top security stuff and leave the firmware password well alone ! It’s the sole reason for one of the most frustrating weekends I have ever had in my life .
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back