0

My MacBook Pro was stolen recently. I had it encrypted using Filevault and it required my password for login after woken from sleep.

My password however is just a word of three letters, not abc, def or klm but more like tfj, ksa, ale, etc...

My question is this can they still access my files in any way? Via the guest access maybe or by breaking the password?

Greatly appreciate your answers.

Improve this question
1
  • allow me a provocative question: why enable filevault2 in the first place? with such a weak password you take all the disadvantages (lower disk speed, configuration effort, potential loss of data) without gaining any benefit...
    – n1000
    Commented Dec 10, 2014 at 20:06

2 Answers 2

Reset to default
1

yes brute force will get your password in no time.

Improve this answer
3
  • 1
    According to the article, a 6-letter password gets you 5.6 hours; if that's true, a 3-letter password should take 2 minutes and 18 seconds. Ouch
    – 0942v8653
    Commented Dec 4, 2014 at 13:12
  • 1
    In some cases, after a few wrong attempted passwords, there is a (longer and longer) delay before the next attempt is allowed. Is this not true for FileVault?
    – GEdgar
    Commented Dec 4, 2014 at 18:43
  • @GEdgar: This applies to a scenario when you try to enter the password manually. A skilled hacker would however remove the disk and try keys from a different host system.
    – n1000
    Commented Dec 10, 2014 at 20:02
1

It is possible to brute force a password or recover the recovery key from memory if someone is determined enough. The guest account by default is a Safari only account. It would be to your advantage for them to log in to the Guest account as it activates "Find my Mac" if they jump on to an internet connection. From the guest account they will have no access to the machines files.

In the future, best practice would be to set a firmware password. Without a firmware password set they can still have access to the machine. To be the most secure you should set both filevault 2 and a firmware password.

Improve this answer
3
  • What firmware are you referring to? The HDD can still be removed from the Mac.
    – n1000
    Commented Dec 10, 2014 at 20:00
  • 1
    -1: guest account is not located on the fv2 partition. firmware password is irrelevant, since the HDD can still be removed.
    – n1000
    Commented Dec 10, 2014 at 20:10
  • Where does it say in the above post that the guest account is located on the main partition? Its part of the recovery drive. Even if you remove the hard drive you would still need the recovery key even if you moved it to another machine.
    – tron_jones
    Commented Dec 10, 2014 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .