Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

My friend's MacBook Pro was recently stolen. Fortunately, it was protected with a password. How secure is the built-in protection ?

Can thieves access the data on the hard drive, and at what difficulty?

share|improve this question
2  
It should be noted that most mentions of Filevault in various answers relate to the original Filevault which protected individual user accounts via storing their home directories in an encrypted DMG, and not what we now call Filevault which is whole disk encryption introduced in Lion. Therefore some answers are no longer relevant to a user not noticing the date and assuming current filevault. –  stuffe Feb 13 '13 at 0:25
add comment

3 Answers 3

up vote 15 down vote accepted

It depends on exactly what you mean by:

it was protected with a password

If it means that they were using FileVault, then their data should be pretty much inaccessible.

If it just meant that they had a login password, though, all the thieves have to do is boot the laptop off another disk, and they'll have immediate access to everything on the internal drive.

share|improve this answer
3  
Just one caveat to go along with "their data should be pretty much inaccessible"... if their password was very simple, for example the user's name, a dictionary word or the same as the combination on my luggage, then an attacker could brute force the FileVault DMG file and access the contents. –  Josh Nov 22 '10 at 13:05
add comment

If FileVault is not enabled, there are two easy ways to reset the login password in single user mode without even having access to another computer or installation media.

It doesn't reset the password of the login keychain, but the thief could still access most files normally. They couldn't use auto-fill in Safari or log in to accounts in Mail. But if you had set a webmail site to log in automatically and hadn't disabled the option to reset a password with an Apple ID, the thief could reset the Apple ID (it doesn't currently require answering security questions) and use it to reset the keychain password.

The hash of the login password (which is usually also the password of the login keychain) is stored in /var/db/dslocal/nodes/Default/users/username.plist in 10.7 and 10.8. In 10.7 it was easy to crack even relatively complex passwords by using DaveGrohl, but 10.8 switched to PBKDF2, which limits it to about 10 guesses per second per core.

share|improve this answer
add comment

The current version of FileVault is secure against currently well-known attacks, if best practices are followed.

Some older versions of FileVault had serious issues. See http://en.wikipedia.org/wiki/FileVault#Issues and https://discussions.apple.com/message/18835839#18835839 ; both have more detail. With older versions of and incautiously configured installations of MacOS, it's definitely easy to decrypt the contents of a FileVault-protected drive. Fortunately, those known issues in older versions of FileVault have been fixed.

Google for examples of some "best practices", such as the NSA's configuration guide for Mac OS X.

What was protected by a password is a key question... Do all accounts require a login password? Is there a boot-time password as well? Was Filevault (or other encryption software) used at all? Were good password practices followed? A chain is only as strong as its weakest link.

share|improve this answer
    
I don't understand what are the serious issues that you think are present in the current version of FileVault. The Wikipedia link doesn't help (none of those sound like serious issues to me). The link to the Apple Discussions page doesn't seem relevant to current versions of FileFault. My understanding is that current versions of FileVault are secure and it's very unlikely that an average thief could access the data on a FileVault-protected computer -- the exact opposite of what you wrote. –  D.W. Feb 13 '13 at 3:21
    
Sorry if I upset you, Matthew. I was just trying to help you improve your answer. If your re-read the first sentence of your answer, it certainly could lead a very different impression than what you said in the first first sentence of your comment. –  D.W. Mar 3 '13 at 19:18
1  
P.S. When you mention "best practices" (where failing to follow them might endanger the security of the current version of FileVault), I think it would help if you listed them explicitly. One must enable FileVault and choose a good passphrase; would you care to list the other "best practices" that are needed for security? I suspect others who visit this question would benefit if you would care to elaborate. –  D.W. Mar 3 '13 at 19:19
    
Thanks for the feedback. It looks like I tweaked my answer to make it clearer. Any further suggestions? Doh! I just realized that it was you who improved my answer. Yay. Still getting the hang of things on Stack sites, and/or they're changing. ('About' says I can't edit posts but I can - but my edits are moderated; you can edit my answer, but have <<2000 points...) Anyway, I guess the right thing to do now is to delete most of our comments, above? Interesting editing here...like Wikipedia, but not too much! :-) As for (not) being upset, NVC is helping me be better at that! –  Matthew Elvey Mar 14 '13 at 19:44
    
@D.W.: Re. "best practices": When answering, I started writing specifics, but decided it's probably best to simply say best practices, not re-answer. Others have done a good job already - with audit standards like ISO27001. gog.is/mac+os+x+security+best+practices shows the NSA's goo.gl/ineX4, etc. I wouldn't be surprised if there's a separate Q&A or or even series of questions, perhaps at <security.stack...> where you are so busy. There's so much - e.g. what I cover at elvey.com/insecure , no one else is covering! –  Matthew Elvey Mar 14 '13 at 20:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.