How can you verify that FileVault 2 is enabled on a macbook?

Question

I bought a Macbook Pro the other day to test out to see if I like it enough to switch from Linux on my personal laptop. Aside from numerous aches and pains as I try to learn the Mac way of doing things, one big thing that I find disconcerting is FileVault for FDE - I'm used to LUKS where I set it up during installation and I'm prompted for my password during boot, prior to reaching my graphical interface. Because of how this works and because I'm the only person who uses my computers, I tend to have a very complex LUKS password for startup, and a much less complex account password for my local user account.

On MacOS, however, it seems to be tied to your user account login. There's no boot prompt and it gets all the way to the MacOS user login screen before I'm asked for a password, so I have to assume that this is the only password keeping FileVault secure.

So I have two questions:

1. Is this correct? The security of FDE on a Macbook depends on your local account password and not on a separate password?

2. Is there a way to easily verify that I have in fact correctly enabled Filevault 2?

Answer 1

You can check whether FileVault2 is enabled by opening System Preferences > Security & Privacy and looking at the FileVault tab.

Passwords for FV2 work slightly different than what you are used to from Linux:

• The FV keys are stored on your computer
• Your account password is required to unlock the keys (and therefore the encrypted disk)
• You need to specifically allow users to unlock a FV encrypted disk so there could be user accounts which aren't allowed to unlock (and therefore can't login until an authorized user unlocks the disk first)

Answer 2

The way to tell if you have FileVault2 enabled is to look at the System Preferences > Security & Privacy > Filevault. It tells you there whether it is enabled or not. Looks like I was beat to this part.

According to the same page, "FileVault requires that you log in every time your Mac starts up, and no account is permitted to log in automatically."

I'd say you don't have it turned on, but check the Security & Privacy prefs just to double-check.