1

I have a MacBook Pro with full disk encryption. I'd like to secure my information from someone who steals my computer or has physical access to it while it's unattended. Are any of these methods more effective than others?

  1. Lock Screen with password required
  2. Sleep
  3. Log out
  4. Shut down

I'm interested in attacks that would allow them to unlock and use the computer as well as ones that would allow them to access information stored on the computer without unlocking it.

This question is partly theoretical, so for the current purposes please assume that:

  • The attacker can't guess / brute-force the password
  • I'm not concerned about hardware attacks like inserting a hidden microphone or physical keylogger
  • I'm not interested in options to remotely wipe or lock the computer
  • I understand that there's no such thing as perfect security; I'm just interested in differences between the options
4
  • What form of full-disk encryption are you using? – IconDaemon Feb 22 '18 at 18:46
  • Would security.stackexchange.com be a better place for a question of this depth? I suspect there it would attract more informed answers. – Graham Miln Feb 22 '18 at 19:56
  • That's not the vector of attack you need to worry about. Phishing, Spear Phishing, Social Engineering are what you need to worry about. A vast majority of what you (don't) do contributes to weak security (i.e. indiscriminately clicking on links or plugging in flash drives you find on the street). Worrying about locking vs. sleeping vs. shutting down is like worrying about closing the door vs. the windows to keep out the rain, but the roof has blown off. – Allan Feb 22 '18 at 20:17
  • @IconDaemon FileVault – octern Feb 22 '18 at 23:46
3

Shut Down

Shutting down your computer is better than all the other methods. A shut down computer has less surface area to attack.

Who is the Attacker?

If the attacker is a nation state, well funded, or highly motivated, then the difference between a computer that is asleep, logged out, or locked is likely insignificant. For all these states, the computer is booted with the storage accessible to at least one process.

If the attacker is one of the above, then physical access will be enough to compromise your computer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .