I just woke up to the fact that it looks like user data can be leaked when using FileVault and Migration Assistant on an SSD on a new Mac when following the default prompts.

When I set up a new Mac, it encourages me to "Transfer Information to This Mac" early in the process, before I'm allowed to enable FileVault. This is OK on an HDD because even though I'm copying my data to the new Mac in the clear, FileVault will eventually overwrite all of it with encryption.

On an SSD, however, it's impossible to overwrite data securely:

... the Mac's "Secure Erase Trash" function leaves 2/3rds of a file recoverable.

— Mac fail: SSD security

... it is almost impossible to securely delete an individual file on an SSD, because the way that SSDs write and delete files is scattered, and a user has no control over what an SSD is doing where. If that's the kind of security you're looking for, your best bet is encryption ...

— Ask Ars: How can I securely erase the data from my SSD drive?

So by the time I'm allowed to enable FileVault, it's too late. Even worse, I can't securely wipe the drive before selling the computer later:

With OS X Lion and an SSD drive, Secure Erase and Erasing Free Space are not available in Disk Utility. These options are not needed for an SSD drive because a standard erase makes it difficult to recover data from an SSD. For more security, consider turning on FileVault 2 encryption when you start using the SSD drive.

— Mac OS X: About Disk Utility's erase free space feature (support.apple.com/kb/HT3680)

So it looks like the solution is:

1. Skip the Migration Assistant when prompted.
2. Create a new user account.
3. Enable FileVault.
4. Run the Migration Assistant.

I'm assuming that even though FileVault is still encrypting the disk before I run Migration Assistant (my computer tells me it has 36 minutes of encryption time remaining) that all new writes made by Migration Assistant will be encrypted and thus my data will never touch the NANDs in the clear.

Do you agree with the problem and my solution?

I just woke up to the fact that it looks like user data can be leaked when using FileVault and Migration Assistant on an SSD on a new Mac when following the default prompts.

When I set up a new Mac, it encourages me to "Transfer Information to This Mac" early in the process, before I'm allowed to enable FileVault. This is OK on an HDD because even though I'm copying my data to the new Mac in the clear, FileVault will eventually overwrite all of it with encryption.

On an SSD, however, it's impossible to overwrite data securely:

... the Mac's "Secure Erase Trash" function leaves 2/3rds of a file recoverable.

— Mac fail: SSD security

... it is almost impossible to securely delete an individual file on an SSD, because the way that SSDs write and delete files is scattered, and a user has no control over what an SSD is doing where. If that's the kind of security you're looking for, your best bet is encryption ...

— Ask Ars: How can I securely erase the data from my SSD drive?

So by the time I'm allowed to enable FileVault, it's too late. Even worse, I can't securely wipe the drive before selling the computer later:

With OS X Lion and an SSD drive, Secure Erase and Erasing Free Space are not available in Disk Utility. These options are not needed for an SSD drive because a standard erase makes it difficult to recover data from an SSD. For more security, consider turning on FileVault 2 encryption when you start using the SSD drive.

— Mac OS X: About Disk Utility's erase free space feature (support.apple.com/kb/HT3680)

So it looks like the solution is:

1. Skip the Migration Assistant when prompted.
2. Create a new user account.
3. Run Software Update to completion to generate more entropy before enabling FileVault in order to mitigate this "worst-case scenario, in which the PRNG has only been seeded with the least amount of entropy" — Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption (eprint.iacr.org/2012/374.pdf), page 9.
4. Enable FileVault.
5. Run the Migration Assistant.

I'm assuming that even though FileVault is still encrypting the disk before I run Migration Assistant (my computer tells me it has 36 minutes of encryption time remaining) that all new writes made by Migration Assistant will be encrypted and thus my data will never touch the NANDs in the clear.

Do you agree with the problem and my solution?