0

I thought I had enabled full volume encryption on my OS X 10.9.5 MBP. Then I created a new user and when rebooting, this new user is able to log in without knowing the password for the disk.

The start up screen is presented with the new user to the left and the normal "Unlock disk" (or something like that) icon to the right – if I want to log in with my normal admin account, I first have to unlock the disk and then my user becomes visible.

What gives?

  • You had several questions in here. This site works better when there is only one question per question. That way, it's easier for other people to find solutions if they have the same problem. I've edited out your other questions, but feel free to ask it separately. – nohillside Jan 4 '16 at 10:21
5

From Apple KB - Use FileVault to encrypt the startup disk on your Mac
Emphasis mine...

Enable users

If you enable FileVault on a Mac with more than one user account, you're asked to identify which users can unlock your startup disk as part of setup. Click Enable next to a user name to let that user log in to your Mac at startup. Then, enter the password for that account.

Users that you don't enable can't unlock the startup disk. These users aren't able to use your Mac until after an enabled user logs in.

Any new user accounts you create after you turn on FileVault are automatically enabled.

  • Thanks! So – this means that the totally insecure password that I've assigned to the new user actually unlocks my full disk encryption? – dalgard Jan 4 '16 at 12:13
  • 1
    Yes, as you've [albeit unwittingly] allowed that. If you disable it, then they will have no access whatsoever until you unlock it… then they'll have access. Depending on whether it's an admin or restricted account will change what they then have access to. – Tetsujin Jan 4 '16 at 12:21
  • Something fishy going on there. The more users are added to the system the more passwords can decrypt the disk. You can revoke a user to be able to decrypt however, but that seems to enforce a complete login of that user prior. Deleting that user from the system and filevault will automatically add the last user as able to decrypt. When one installs macos on an encrypted system then macos will not have a user originally, and that works fine. MacOs asks you for a disk password, but as soon as you add a user, then disk password seems to be impossible to get back. I want separate passwords ... – momomo Nov 20 '19 at 17:40
  • ... not a disk password which I am typing in five thousand times a day on various other things in the system. I can create a separate user sure but as of know macos seems to force me to login to that user and then logout and login again with the user in question. Why can't we just have the original disk password, that seems possible and implemented already. Wierd. Just as wierd as Microsoft forces you to backup your encryption key or password to their cloud, so that a government can get access to it if need to. Why won't microsoft allow you to remember the password yourself? – momomo Nov 20 '19 at 17:42
  • ... Is Apple doing something similar here? Intentionally weakening it's encryption and leave a bunch of vulnerbilities such as the ability to simply add a user which can surely be done just by getting access to any users account, even the account without filevault access, and with a password that can be comprised easily since that password is in keychain and entered 10 000 times a day. tim cook sure pulled a good one on us with the fbi phone. – momomo Nov 20 '19 at 17:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .