17

Does FileVault 2 in Lion have any other differences compared to the old version, FileVault in previous releases of the system? Are there any additional benefits to using the new version?

Improve this question

16 Answers 16

Reset to default
7

Borrowing heavily from John Siracusa's Lion review...

FileVault 2 is a Whole Disk Encryption system, as opposed to just a 'store your home folder in an encrypted disk image' solution. It's implemented as a filesystem layer below the actual volume that you unlock at system boot time. If you're familiar with LVM, it's much the same way. Whenever you get past the password lock, everything looks the same to the rest of the system.

As Steve mentioned, the encryption work can be aided by specialized processor instructions, and runs entirely in the background. What's nice is that you can turn disk encryption on a full drive, and everything will be done at leisure (you can shut it down, bring it back up, etc. and everything will continue).

Improve this answer
9

Password less 'Guest' accounts can no longer be created since the whole disk is encrypted than just the User's home directory. It's sad that I could not find any information on the kb article in Apple about this.

Improve this answer
8
  • 3
    Wow, this is a pretty big difference that went unnoticed to me! This really has a pretty big impact on theft recovery strategies that recommend setting up a passwordless guest account.
    – Aron Rotteveel
    Aug 4, 2011 at 13:47
  • @Aron But you could still setup a guest account with a clear text password hint.
    – Asmus
    Aug 5, 2011 at 6:20
  • 2
    @Asmus, of course, but that would pretty much make Filevault useless alltogether.
    – Aron Rotteveel
    Aug 5, 2011 at 7:14
  • @Aron but how is that more insecure than the "old method" used to be? A "passwordless" guest account is still the same as when you tell the guest the password?!
    – Asmus
    Aug 5, 2011 at 12:52
  • 2
    Obviously, the fact that the disk is encrypted in total by any user login makes a guest login useless when you use it as a theft recovery tool. In most cases, Filevault 1 would be a better solution
    – Aron Rotteveel
    Aug 5, 2011 at 12:58
7

The new Filevault seems to put far fewer constraints on you than the old version. You don't have to log out for time machine to work, for example, and all the sharing daemons appear to work fine (some of them were disabled when filefault was enabled if I recall correctly. I think web sharing was among them, which made my laptop a bit useless as a development platform for web applications :) ).

One problem with Filevault 2 is you can't ssh into a machine until you've entered a password locally, as the startup process can't commence until the encrypted drive has been unlocked.

Improve this answer
2
  • "You don't have to log out for time machine to work, for example, and all the sharing daemons appear to work fine ": OTOH this probably means that Time Machine backups are no longer encrypted now, and sharing daemons (and malware) can now also get to the files.
    – Thilo
    Jul 22, 2011 at 4:34
  • Time Machine backups need to be encrypted separately, but it's still possible. This can be done from Time Machine Preferences > Select Disk > Check box to encrypt disk,
    – Gauzy
    Jul 25, 2011 at 1:27
4
  • It supports AES-NI which offloads encrypting and decrypting on supported CPUs (some core i5's and i7's).
  • You can store your encryption key with Apple.

I'm sure there are a few other. This Apple support article should answer the rest of your questions.

http://support.apple.com/kb/HT4790

Improve this answer
1
  • In case someone doesn't know why it's useful, AES-NI support means lower CPU utilization for better performance and battery life.
    – jmk
    Oct 17, 2012 at 6:38
4

FileVault 2 LVG failures may be irreparable

From the manual page for fsck_cs:

The fsck_cs utility verifies and repairs CoreStorage logical volume group metadata.

...

BUGS

fsck_cs does not perform an exhaustive validation, nor is it able to fix many of the inconsistencies that it does detect.

Issues with FileVault 1

fsck_hfs (used by Disk Utility) has been developed for more than ten years and is capable of repairing most issues with JHFS+ as used by FileVault 1.

Should you encounter an issue that fsck_hfs can not repair, there are multiple alternative third party utilities.

Core Storage issues with FileVault 2

fsck_cs (also used by Disk Utility) first appeared along with CoreStorage in Mac OS X 10.7.0. Inconsistencies may be irreparable.

In the absence of alternatives to fsck_cs

If LVG failure occurs and fsck_cs can not make necessary repairs, then your startup volume will not mount. In this situation you may destructively reformat the disk and reinstall Mac OS X. (Using Recovery OS Time Machine alone will not provide the Apple_Boot Recovery HD that's required for FileVault 2.)

Improve this answer
3

One drawback I can see is that before you could encrypt individual user accounts, whereas now you can only encrypt the whole disk. If you encrypt the whole disk, you also have to decrypt the whole disk every time you use the computer. This means that once the computer is booted, the whole disk is accessible to malware, whereas before you could log in (and soon again out of) to security-critical accounts separately.

I suppose you can still use encrypted disk images on top of FileVault for really important data.

Another problem could be Time Machine. Whereas before the FileVault users' directories were also stored encrypted on the backup volume, that does not seem to be the case anymore.

Does anyone know if Time Machine now support whole-disk encryption as well (from the reports so far it seems to be not enabled for external drives, at least not via the GUI)?

Update: Apparently, Time Machine does not support whole-disk encryption: Can Time Machine volumes be easily encrypted with FileVault 2?

Improve this answer
1
  • 1
    If we make distinction between a disk and a logical volume: Time Machine might not use whole disk encryption, but for encryption Time Machine does apply Core Storage full disk encryption (FDE) (as it's described in the manual page for diskutil) to the whole of the backup volume.
    – Graham Perrin
    Aug 4, 2011 at 15:59
2

For multiple administrators: FileVault 2 alone is less secure than FileVault 1 

Similar to the answer offered by Thilo. This logic applies to any computer with two or more administrators.

FileVault 1 in Snow Leopard and in Lion

There is a good level of security to prevent a person without the master password from accessing any other person's data.

FileVault 2 alone

Any administrator can view, copy, edit all other users' data.

Example

Two business partners share a computer, both administrators. One of the two partners might like to keep something private. The partner who holds the master password, who wishes to keep something private, does not give that password to the other partner.

With FileVault 2 alone in such scenarios, security and privacy are easily ignored — sudo comes immediately to mind.

Comparison

ZFS encryption in Oracle Solaris, which can apply to users' home directories.

Workaround

If a user of FileVault 2 in the situation above requires the extra security, that person can:

  1. add a separate disk, internal or external
  2. on that disk, have a Core Storage encrypted logical volume (LV) with a Disk Password that differs from both (a) the Disk Password for the OS startup volume and (b) all user passwords for the startup volume
  3. store their home directory on the LV on the separate disk
  4. match the password for their user account to the Disk Password for the LV.

Alternatively, that person might use just a part of an existing disk … but partition management in and around coreStorage world is difficult, so for long-term simplicity: I would recommend investment in an additional/separate disk.

/var/folders

Expect some user data to be written to a subdirectory of /private/var/folders – all administrators will have access to this data. A solution for this is beyond the scope of this question.

Improve this answer
3
  • I agree that FileVault 1 was better for a multi-user computer where you wanted to separate them from each-other, but I think even with FileVault 1 the System Administrator could always decrypt any other user's vault.
    – Thilo
    Aug 4, 2011 at 23:53
  • @Thilo in FileVault 1 the only accepted way of unlocking someone else's vault was with a master password, which was never automatically given to all administrators. I edited my answer to make this clearer. Thanks for the prompt.
    – Graham Perrin
    Aug 5, 2011 at 5:46
  • 1
    For greater security: a partition for one user's home directory can be carved from the disk that's to be used for installation of OS X – before the OS is installed. See for example Encrypt the startup volume with Core Storage without FileVault. However, this can not be performed with Apple's System Preferences interface to FileVault 2, and critically: if it's later discovered that a partition is too small, it will be impossible to shrink or grow any partition that is encrypted.
    – Graham Perrin
    Dec 30, 2012 at 4:55
1

Partition management in and around coreStorage world is difficult

For a disk that uses FileVault 2 — or any other application of Core Storage — it may be impossible to add or resize partitions using Disk Utility.

In Super User:

  • an answer under How do I resize a FileVault 2 encrypted partition?
  • an answer under Create new partition on encrypted volume in OS X Lion.

Expect Apple's diskutil(8) Mac OS X Manual Page to be updated for 10.7 in due course. In the meantime, if you already installed Lion, read the man page in Terminal.

Improve this answer
1

FileVault 1 can be disabled for individuals

For any user who uses FileVault 1:

  • System Preferences allow you to disable FileVault for that user alone, provided there is sufficient free space.

Enabled users of FileVault 2 can not be disabled

In Mac OS X 10.7 (Build 11A511) you can allow a user to unlock the startup volume, but once enabled:

  • that user alone can not be disabled
  • only FileVault 2 in its entirety can be disabled.

Disable a user's ability to unlock a FileVault 2 volume at startup/login time

Improve this answer
1

Lion Recovery Disk Assistant lacks support for FileVault 2

Version 1.0 of the assistant used with FileVault 2 in Mac OS X 10.7 (Build 11A511) does produce a Recovery OS on a USB flash drive. However:

  • the computer can not boot from that Recovery OS.

I found this problem with two different computers.

Improve this answer
0

FileVault 1 impact on performance

In my experience, the impact is usually acceptable. I'd like to see relevant benchmarks.

Performance comparisons

In Ask Different: Speed of old Filevault vs. new Lion full disk encryption

FileVault 2 impact on performance

Apple suggests:

FileVault 2 encrypts and decrypts your data on the fly with an imperceptible performance impact.

— page cached 2011-07-28.

AnandTech — Back to the Mac: OS X 10.7 Lion review: FileVault performance observes:

… Overall the hit on pure I/O performance is in the 20 - 30% range. It's noticeable but not big enough to outweigh the benefits of full disk encryption. …

I'd like the AnandTech reviewers to weigh things again more broadly, to include at least:

  • FileVault 1 in lieu of FileVault 2.

More observations on CPU, kernel_task et cetera in Re: [Fed-Talk] Lion FileVault (2011-07-22) (highlights).

Improve this answer
0

FileVault 2 prevents remote restart

Do not expect remote access to the EFI loginwindow.

Improve this answer
6
  • I've changed your style to something more readable.
    – Loïc Wolff
    Aug 4, 2011 at 13:58
  • @Loïc heading levels 1, 2 and 3 seem the norm at, for example What tiny thing in Lion makes you smile or has caught you off guard? — is there a meta question for a answer on use of style? Meantime, please refrain from editing the others — thank you.
    – Graham Perrin
    Aug 4, 2011 at 14:02
  • 1
    That was just to make the answer more readable, h1 is good for short title but not long phrases, IMO. Feel free to rollback if you prefer the old style.
    – Loïc Wolff
    Aug 4, 2011 at 14:04
  • 3
    @Graham, this is a community-driven website which is based on editing eachother's posts. There is nothing wrong with headings, but to be quite honest, I find you posts very hard to read.
    – Aron Rotteveel
    Aug 4, 2011 at 14:05
  • @Aron please, feel free to edit content improve readability. I might roll back or re-edit considerately. I'll leave the three heading levels in at least one of the answers. Currently migrating to Ask Different information that was originally drafted around identi.ca/conversation/77065575#notice-79879336 …
    – Graham Perrin
    Aug 4, 2011 at 14:08
0

Disabling FileVault 1 may worsen performance

Two reasonably-sized volumes (one a home directory), with a good set of B-trees, are probably easier for the system to manage — and almost certainly perform better — than a single colossal volume with attributes and catalog B-trees that are oversized and fragmented.

Explanation

FileVault 1 uses bands of a size that is optimised.

Depending on the content of a home directory, abandoning those bands in favour of a greater number of smaller files may significantly increase the sizes and fragmentation of the following critical areas of the startup volume:

  • attributes B-tree
  • catalog B-tree
  • extents B-tree.

Enlarged B-trees can be unexpectedly problematic

What follows is debatably beyond the scope of the opening question, and relatively technical, but for any user of a computer with (a) limited memory and (b) a considerable number of files within and outside their home directory, it's worth thinking about before abandoning FileVault 1.

If the sum of the sizes of the B-trees is too great, and if repair is required, third party utilities on your computer may be unable to repair the damage.

If a volume is irreparable by fsck_hfs — most obviously using Disk Utility, less obviously whenever the system encounters a file system that is dirty — a user may turn to a respected third party utility.

Example

I encountered a situation where the sum of the sizes of the B-trees — in relation to the physical memory — was too great for a third party utility to work as required for a Core Storage encrypted backup volume that was irreparable by fsck_hfs. As my MacBookPro5,2 can take no more than 8 GB, so for some time this volume was read only.

I might have taken the volume, with or without the computer, to a service provider for attention in an environment with more memory. However for security, I should not provide to any third party — however well trusted — the passphrase or key for some types of volume.

Eventually and unexpectedly the fsck_hfs in Lion did repair the volume without me using Disk Utility, possibly thanks to me experimentally (riskily?) removing the volume from coreStorage world (reverting, completely converting backwards) whilst in the irreparable and read-ony state. That was a pleasing outcome for me, and a thumbs-up to Apple for the qualities and capabilities of 10.7 (Build 11A511), but this should serve as a caution to other readers.

Improve this answer
4
  • I don't understand the part of "abandoning bands versus many small files". I though File Vault 2 encryption happens below the level of the file system, on a block level, and thus should not behave differently from unencrypted HFS+ regarding B-trees.
    – Thilo
    Aug 4, 2011 at 23:55
  • @Thilo without thinking about levels, or encryption: think of numbers of files. An extreme example: add one million 80 KB files to a volume, then remove 10,000 8 MB bands. Adding one million files is likely to increase the sizes of the attributes and catalog B-trees, maybe coinciding with fragmentation of one or both which is never good for performance. Subsequent removal of a smaller number of files may not be followed by a reduction in size to either B-tree.
    – Graham Perrin
    Aug 5, 2011 at 5:59
  • But wouldn't you have the same one million files in the B-tree on the HFS+ inside your disk image? Maybe I am misunderstanding something. Anyway, I think I know what you mean. This is not about encryption or FileVault at all, but "partitioning" your file system using disk images, because you do not trust HFS+ to manage millions of files, right?
    – Thilo
    Aug 5, 2011 at 6:05
  • I do trust JHFS+ (with journalling) with many millions of files — currently 4,062,789 files and 438,294 folders on the startup volume of my MacBookPro 5,2 — 3,151,819 files on a PowerPC Xserve, parts of which serve a workgroup — and so on. My answers in this question originated from a non-collaborative work in progress elsewhere; this answer in particular needs some attention, probably below the opening heading. Watch this space and join me in editing. Thanks again for the prompt …
    – Graham Perrin
    Aug 5, 2011 at 6:19
0

Some installations can not use FileVault 2

Not all installations of Lion gain the hidden Apple_Boot Recovery HD that is required for FileVault 2 — OS X Lion: "Some features of Mac OS X Lion are not supported for the disk (volume name)" appears during installation (2011-07-21).

… You won't be able to use FileVault …

If this happens — and if you abandoned FileVault 1 before the upgrade to Lion — your Mac with Lion will be less secure.

The advice published by Macworld before the release of Lion continues to advise users to disable FileVault 1 before installing Lion. It's most unusual for Macworld to give advice that is contentious but in this case, I disagree strongly.

Improve this answer
0

Lion makes FileVault 1 homes less easy to create

Easiest to create the FileVault 1 home in Snow Leopard before upgrading to Lion.

If without Snow Leopard: you can use Lion to create the home, but there are a few steps to the routine.

After disabling Filevault 1, is it possible to enable it again in Lion?

Improve this answer
0

By combining FileVault 2 with FileVault 1, you can have double layer security. Note that this is will cause troubles with TimeMachine and sharing. Therefore, this double layer security is only advisable for an account where TimeMachine is turned off!

On my computer, I have an everyday work account, a FileVault 1 account (excluded from TimeMachine) and an administrator account. When I activated FileVault 2 from my everyday work account (using the administrator account's password), I expected FileVault 1 to disappear because Apple says at OS X Lion: About FileVault 2: «If you turn off Legacy FileVault, the Legacy FileVault tab will disappear and you can then choose to enable OS X Lion's FileVault 2».

When FileVault 2 was all set up, I was very surprised that my FileVault 1 continued having FileVault 1 encryption. So I had a double layer security: A legacy FileVault 1 account within a FileVault 2 computer. All I needed was a non-FileVault 1 account from where to turn on FileVault 2.

Eventually, I turned off FileVault 2 again. I like being able to access the OS X filesystem from the Bootcamp Windows system. With FileVault 2, that was no longer possible. I still keep the FileVault 1 account and it continues working fine, even in 10.8.1.

Improve this answer
2
  • You also get all the drawbacks of FV1 like TimeMachine problems, sharing access (or rather non-access) etc. A better solution (if you really need the small additional level of security) is probably to encrypt the disk with FV2 and add a small image/dmg for the really sensitive stuff.
    – nohillside ♦
    Nov 14, 2011 at 19:16
  • That's certainly true. It does not affect me since I have turned off TimeMachine for that account and don't share it. I'm editing the answer accordingly.
    – mach
    Aug 31, 2012 at 8:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .