Does FileVault 2 in Lion have any other differences compared to the old version, FileVault in previous releases of the system? Are there any additional benefits to using the new version?
Borrowing heavily from John Siracusa's Lion review...
FileVault 2 is a Whole Disk Encryption system, as opposed to just a 'store your home folder in an encrypted disk image' solution. It's implemented as a filesystem layer below the actual volume that you unlock at system boot time. If you're familiar with LVM, it's much the same way. Whenever you get past the password lock, everything looks the same to the rest of the system.
As Steve mentioned, the encryption work can be aided by specialized processor instructions, and runs entirely in the background. What's nice is that you can turn disk encryption on a full drive, and everything will be done at leisure (you can shut it down, bring it back up, etc. and everything will continue).
Password less 'Guest' accounts can no longer be created since the whole disk is encrypted than just the User's home directory. It's sad that I could not find any information on the kb article in Apple about this.
|show 3 more comments|
The new Filevault seems to put far fewer constraints on you than the old version. You don't have to log out for time machine to work, for example, and all the sharing daemons appear to work fine (some of them were disabled when filefault was enabled if I recall correctly. I think web sharing was among them, which made my laptop a bit useless as a development platform for web applications :) ).
One problem with Filevault 2 is you can't ssh into a machine until you've entered a password locally, as the startup process can't commence until the encrypted drive has been unlocked.
I'm sure there are a few other. This Apple support article should answer the rest of your questions.
One drawback I can see is that before you could encrypt individual user accounts, whereas now you can only encrypt the whole disk. If you encrypt the whole disk, you also have to decrypt the whole disk every time you use the computer. This means that once the computer is booted, the whole disk is accessible to malware, whereas before you could log in (and soon again out of) to security-critical accounts separately.
I suppose you can still use encrypted disk images on top of FileVault for really important data.
Another problem could be Time Machine. Whereas before the FileVault users' directories were also stored encrypted on the backup volume, that does not seem to be the case anymore.
Does anyone know if Time Machine now support whole-disk encryption as well (from the reports so far it seems to be not enabled for external drives, at least not via the GUI)?
Update: Apparently, Time Machine does not support whole-disk encryption: Can Time Machine volumes be easily encrypted with FileVault 2?
FileVault 2 LVG failures may be irreparable
From the manual page for
Issues with FileVault 1
fsck_hfs (used by Disk Utility) has been developed for more than ten years and is capable of repairing most issues with JHFS+ as used by FileVault 1.
Should you encounter an issue that
Core Storage issues with FileVault 2
In the absence of alternatives to fsck_cs
If LVG failure occurs and
For multiple administrators: FileVault 2 alone is less secure than FileVault 1
Similar to the answer offered by Thilo. This logic applies to any computer with two or more administrators.
FileVault 1 in Snow Leopard and in Lion
There is a good level of security to prevent a person without the master password from accessing any other person's data.
FileVault 2 alone
Any administrator can view, copy, edit all other users' data.
Two business partners share a computer, both administrators. One of the two partners might like to keep something private. The partner who holds the master password, who wishes to keep something private, does not give that password to the other partner.
With FileVault 2 alone in such scenarios, security and privacy are easily ignored — sudo comes immediately to mind.
ZFS encryption in Oracle Solaris, which can apply to users' home directories.
If a user of FileVault 2 in the situation above requires the extra security, that person can:
Alternatively, that person might use just a part of an existing disk … but partition management in and around coreStorage world is difficult, so for long-term simplicity: I would recommend investment in an additional/separate disk.
Expect some user data to be written to a subdirectory of
FileVault 1 can be disabled for individuals
For any user who uses FileVault 1:
Enabled users of FileVault 2 can not be disabled
In Mac OS X 10.7 (Build 11A511) you can allow a user to unlock the startup volume, but once enabled:
Lion Recovery Disk Assistant lacks support for FileVault 2
Version 1.0 of the assistant used with FileVault 2 in Mac OS X 10.7 (Build 11A511) does produce a Recovery OS on a USB flash drive. However:
I found this problem with two different computers.
FileVault 1 impact on performance
In my experience, the impact is usually acceptable. I'd like to see relevant benchmarks.
In Ask Different: Speed of old Filevault vs. new Lion full disk encryption
FileVault 2 impact on performance
I'd like the AnandTech reviewers to weigh things again more broadly, to include at least:
FileVault 2 prevents remote restart
Do not expect remote access to the EFI loginwindow.
|show 1 more comment|
Partition management in and around coreStorage world is difficult
For a disk that uses FileVault 2 — or any other application of Core Storage — it may be impossible to add or resize partitions using Disk Utility.
In Super User:
Expect Apple's diskutil(8) Mac OS X Manual Page to be updated for 10.7 in due course. In the meantime, if you already installed Lion, read the man page in Terminal.
Disabling FileVault 1 may worsen performance
Two reasonably-sized volumes (one a home directory), with a good set of B-trees, are probably easier for the system to manage — and almost certainly perform better — than a single colossal volume with attributes and catalog B-trees that are oversized and fragmented.
FileVault 1 uses bands of a size that is optimised.
Depending on the content of a home directory, abandoning those bands in favour of a greater number of smaller files may significantly increase the sizes and fragmentation of the following critical areas of the startup volume:
Enlarged B-trees can be unexpectedly problematic
What follows is debatably beyond the scope of the opening question, and relatively technical, but for any user of a computer with (a) limited memory and (b) a considerable number of files within and outside their home directory, it's worth thinking about before abandoning FileVault 1.
If the sum of the sizes of the B-trees is too great, and if repair is required, third party utilities on your computer may be unable to repair the damage.
If a volume is irreparable by fsck_hfs — most obviously using Disk Utility, less obviously whenever the system encounters a file system that is dirty — a user may turn to a respected third party utility.
I encountered a situation where the sum of the sizes of the B-trees — in relation to the physical memory — was too great for a third party utility to work as required for a Core Storage encrypted backup volume that was irreparable by
I might have taken the volume, with or without the computer, to a service provider for attention in an environment with more memory. However for security, I should not provide to any third party — however well trusted — the passphrase or key for some types of volume.
Eventually and unexpectedly the
Some installations can not use FileVault 2
Not all installations of Lion gain the hidden
If this happens — and if you abandoned FileVault 1 before the upgrade to Lion — your Mac with Lion will be less secure.
The advice published by Macworld before the release of Lion continues to advise users to disable FileVault 1 before installing Lion. It's most unusual for Macworld to give advice that is contentious but in this case, I disagree strongly.
Lion makes FileVault 1 homes less easy to create
Easiest to create the FileVault 1 home in Snow Leopard before upgrading to Lion.
If without Snow Leopard: you can use Lion to create the home, but there are a few steps to the routine.
By combining FileVault 2 with FileVault 1, you can have double layer security. Note that this is will cause troubles with TimeMachine and sharing. Therefore, this double layer security is only advisable for an account where TimeMachine is turned off!
On my computer, I have an everyday work account, a FileVault 1 account (excluded from TimeMachine) and an administrator account. When I activated FileVault 2 from my everyday work account (using the administrator account's password), I expected FileVault 1 to disappear because Apple says at OS X Lion: About FileVault 2: «If you turn off Legacy FileVault, the Legacy FileVault tab will disappear and you can then choose to enable OS X Lion's FileVault 2».
When FileVault 2 was all set up, I was very surprised that my FileVault 1 continued having FileVault 1 encryption. So I had a double layer security: A legacy FileVault 1 account within a FileVault 2 computer. All I needed was a non-FileVault 1 account from where to turn on FileVault 2.
Eventually, I turned off FileVault 2 again. I like being able to access the OS X filesystem from the Bootcamp Windows system. With FileVault 2, that was no longer possible. I still keep the FileVault 1 account and it continues working fine, even in 10.8.1.