7

Before today, with 10.12, and now (High Sierra 10.13), I had DestroyFVKeyOnStandby 1. With 10.12, I would open the lid to my laptop after it had been hibernating for a bit, hit the power button, and I would be prompted for 2 passwords (identical). I would enter the first password, a status bar would progress, and then I would be prompted for the second password.

With 10.13, everything is the same, but the first password prompt is missing. I always figured the status bar (in 10.12) meant it was decrypting the disk (or part of it). If that is the case, now it's decrypting before it even asks me for the one password to let me in. That is to say, there is the status bar, then the password prompt.

Any clarity on why this might be different and if there is anything we should know would be appreciated.

UPDATE After toggling DestroyFVKeyOnStandby and restarting a few times (ultimately, I changed nothing), the situation is as follows:

After hibernating, I press power key, Apple logo appears, enter FileVault/Login PW, progress bar, finally desktop. This is the opposite of my previous situation [progress bar -> PW prompt]. Good, but still only one PW prompt. Why? My guess is the machine knows they are the same (set them at the same time)?

I can now recreate my previous situation by setting DestroyFVKeyOnStandby 0(it wasn't 0 before). This is what 0 should do.

Additionally if I set DestroyFVKeyOnStandby 1 and turn off sleep-screen-lock, I am still prompted for a PW. This leads me to believe my machine is asking for my FileVault PW, the intended outcome.

I guess my final advice would be to fiddle with your DestroyFVKeyOnStandby a bit and restart a few times. I know that's not very scientific, but it shouldn't hurt.

  • In both cases a clear explanation on what is performed and in which order is mandatory. Security and trust come with transparency. – dan Oct 2 '17 at 5:54
  • I having the same problem here and can't get hibernation to work like it did pre 10.13 no matter what I try. Can please confirm you have to enter your password twice after your fix? This was how I 'knew' that the machine had fully hibernated and the FV key had been destroyed. – Ralph Oct 4 '17 at 4:00
  • Edited the update for clarity. – user4396386 Oct 4 '17 at 22:47
1

Apparently removing /Library/Preferences/com.apple.PowerManagement.plist, and then running an pmset -a DestroyFVKeyOnStandby 1 as Root has gotten things working reliably again.

I have no idea what is causing this file to take precedence over the com.apple.PowerManagement.<UUID>.plist file again on every update, but it is rather annoying to have to remember to remove the non-UUID config file every time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .