How can I have one password for FileValue 2 (pre-boot password) and another for my user login?

Question

I know this is possible.

When I first installed Mavericks, I set up a default password of "password".

I then enabled Filevault 2.

At some point I then changed my password from "password" to my actual password.

However the pre-boot password is still "password".

I like the fact that there were two different passwords, but I want to change the pre-boot password to something better than "password" (obviously!) but...

How?

On my laptop, I've done some testing and changing the user login password also updates the pre-boot password.

And if I fail the pre-boot password 3 times and use the recovery key, I can update the password, but it only updates the user login password, which in turn automatically updates the pre-boot password.

So they are always in sync.

So how on earth did I originally have 2 different passwords, and how can I continue to have 2 different passwords?

Answer 1

As you've found, there's an sync process when you change your password that automatically updates your account login at the FileVault 2 pre-boot login screen. However, if you're OK with having to login twice, there's a way to set the FileVault 2 login process on Mavericks so that you're stopped at the OS login window after logging in at the FileVault 2 login window.

The way to do this is to disable FileVault 2's automatic login, which is the process that the OS uses to automatically log you into your account after you've logged in at the FileVault 2 pre-boot login screen. Apple has a KBase article here that shows how to do this:

OS X: How to disable automatic login when FileVault is enabled

Passwords

When disabling automatic login, two passwords are required while starting up:

One password is needed to unlock the disk at the EFI Login Window. Another password is needed to log in at the regular Login Window. These passwords can be the same if you are logging in as the user who unlocked the disk.

Command line

Use the following command to disable automatic login when FileVault is enabled:

sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES

Use the following command to allow automatic login when FileVault is enabled:

sudo defaults delete /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin

Once you've disabled automatic login, set up a new local account on your Mac and set it to use a different password from your account's password. New local accounts should be automatically enabled for FileVault 2 access, so you shouldn't need to do anything else. Since this second account is only going to be used as a FileVault 2 login, I'd recommend making it a standard user with no admin privileges.

After that, reboot your Mac and login at the FileVault 2 pre-boot login screen using your new account's password. When the OS unlocks and boots, you should then be stopped at the OS login window. At that point, login with your regular username and password.