3

There are ways to break File Vault 2 encryption: https://www.blackbagtech.com/blog/2017/07/13/macquisition-best-just-got-better/

Since you can reset a password when it's locked, I wonder in practice how secure is FileVault in the real world.

Furthermore, even if someone like the aforementioned Macquisition isn't used, can't someone just login to your user account?

Improve this question
5
  • 2
    FileVault doesn't protect against someone that can guess or get your password. "how secure is" really depends on you specifying your threat model.
    – bmike ♦
    Aug 16, 2017 at 9:56
  • 2
    Disk encryption doesn't protect against people knowing your password
    – nohillside ♦
    Aug 16, 2017 at 10:44
  • Understood, obviously if you told someone your password, having File Vault wouldn't protect your data. What I meant to ask mainly instead was does File Vault protect from methods to obtain your password other than someone finding out from you personally, such as resetting the password on your computer and then logging in, doing some stuff in Terminal to disable the password, making a new user account and then disabling File Vault, etc.
    – user249662
    Aug 17, 2017 at 4:28
  • @bmike you mentioned 'trivial surreptitious attacks' below which is basically what I was referring to, would there be any surreptitious attacks that you didn't mention, other than an individual giving up their password personally, that File Vault wouldn't protect against?
    – user249662
    Aug 17, 2017 at 4:31
  • See my edit to list more clearly what FileVault does for you security wise.
    – bmike ♦
    Aug 17, 2017 at 8:51

1 Answer 1

Reset to default
6

File Vault won't protect you from someone with the means to grab your laptop when you have it unlocked and image it. Neither will it prevent someone from coercing your password from you or just snooping it from reuse / yellow post it notes, etc... https://xkcd.com/538/

https://xkcd.com/538/

FileVault is designed to prevent trivial surreptitious attacks:

  • booting to single user mode to add a new admin account
  • looking at your data (or copying unencrypted files) by booting to another OS that someone brings to your Mac

Filevault is good protection from people that can't or won't steal your password to unlock your drive. In a nutshell, it enforces authorization to decrypt your data, apps and OS with a password of your choosing.

Improve this answer

You must log in to answer this question.