I always wondered how my Mac could connect to the internet when the recovery partition is booted and my main system partition is locked (filevault2).
Some googling revealed today (e.g. here, here, and also on askdifferent) that the WiFi password is apparently stored in NVRAM and that needs to be reset to remove the password. As a security conscious person this is unacceptable to me. When using Full Disk Encryption (i. e. Filevault2) I expect the system to be safe, also against my network.
So is there a way to prevent OS X from making the password available in the recovery partition? I am not sure how or when it gets into NVRAM in the first place.
UPDATE1:
The NVRAM contains the following keys: (nvram -p
) :
BootCampHD
SystemAudioVolume
SystemAudioVolumeDB
aht-results
backlight-level
bluetoothActiveControllerInfo
bluetoothInternalControllerInfo
boot-gamma
efi-apple-recovery
efi-boot-device
efi-boot-device-data
fmm-computer-name
good-samaritan-message
gpu-policy
prev-lang:kbd
The keys efi-apple-recovery
and efi-boot-device
look like they could contain encrypted data.
nvram -p
can you tell from the output which firmware variable is holding the Wi-Fi password? If yes you can clear just that one variable without reseting the entire NVRAM. Usesudo nvram -d variable_name
in a Terminal. – user3439894 Jul 13 '15 at 22:04