2

As I understand it, FileVault makes you login before you computer boots to the OS in order to unlock the drive. This means someone getting ahold of your laptop when it is off cannot get at the data.

What are the implications of using FileVault with sleep? I assume the drive is still considered unlocked during sleep. Anyone that opens the sleeping laptop would have to know your login to do anything with the computer, but is the data insecure to someone very determined at that point (assuming they can't guess your password)?

I was considering turning on FileVault but since I never power down, the answer to this will help me decide what value there is in doing so.

Improve this question

1 Answer 1

Reset to default
2

If you don't require the password when you wake from sleep, then you are leaving yourself open to someone taking control of your data. That is regardless of FileVault.

If you have password set, then the data is still protected from being viewed in a similar method to it being on a locked file vault volume. You can also set a MDM profile to have the FileVault keys destroyed in RAM when the machine enters sleep, so that's pretty much as good as powering off in my book:

For anything but a highly motivated and skilled adversary (think NSA or FBI) - the extra security you get by powering down the Mac is hard to estimate or differentiate from a locked screen.

That being said, you should turn on FileVault if you have an SSD since there is no other way to ensure destruction of sensitive data other than destroying the key that decrypts data on the drive. You can then decide to sleep or to power off based on how secure you judge your physical environment and the data you have on your Mac from moment to moment.

Improve this answer
5
  • This is more of an educational question than a 'I need to hide something' and you hit on the head my actual curiosity. Say someone like the NSA wanted to get in, what benefit does powering down provide compared to locking the account in sleep mode? That's my real question.
    – Kevin Kalitowski
    Commented Feb 19, 2016 at 17:30
  • @KevinKalitowski I just answered the text I saw. If you want to ask a follow on question with some research showing what you found and how it didn't answer your question - that might set the stage for the degree of technical detail you seek and already possess. See How to Ask
    – bmike ♦
    Commented Feb 19, 2016 at 17:43
  • My question is appropriate in its original form. It asked 'is the data insecure to someone very determined'. Your reply did not respond to that point when you said 'for anything but a highly motivated and skilled adversary'. That type of party is just what my question was asking about and what your reply didn't answer.
    – Kevin Kalitowski
    Commented Feb 19, 2016 at 17:50
  • Unless I'm saying a determined foe gets your data, vault or not. Hit me up in Ask Different Chat if you'd like to continue the dialog here... @KevinKalitowski
    – bmike ♦
    Commented Feb 19, 2016 at 17:55
  • Is your answer that FileVault is insecure to any advanced adversaries? I don't believe that. If you hold onto the key, there is next to no chance anyone could get the data from a powered down machine. The question is whether that holds true for a locked, asleep machine as well.
    – Kevin Kalitowski
    Commented Feb 19, 2016 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .