0

In efforts to learn how to protect a new Apple-silicone laptop from theft, I'm trying to decide whether or not to use FileVault.

I know it encrypts all your files on-the-fly, and the barrier to the files is just a password. If FileVault is off and I just set a normal user password, it's also a password barrier. How else can someone access my files with FileVault off?

1
  • In modern hardware, disk encryption carries basically no cost in term of performance or power needs.
    – nohillside
    Oct 19 at 8:24
3

The Apple Silicon Macs all have encryption of the drive enabled at all times - no matter if you enable FileVault or not.

This means that the contents of the drive is encrypted (i.e. not immediately readable) - and you won't be able to just take out the drive (which is in itself a more difficult operation than usual) and read it from another computer. It is certainly not something that an average home user would ever be able to do.

The practical difference between having a password-protected system with FileVault disabled, and a password-protected system with FileVault enabled is how difficult it is to get to your files without knowing your password.

For a password-protected system with FileVault enabled, it is practically impossible for the average home user or even IT professional to get to your files without knowing your password. If you're directly targeted by a nation state, circumstances might be different - but that's not the practical world most of us live in.

For a password-protected system with FileVault disabled, you will ordinarily be required a password to login. However, there are ways to circumvent that and access your files, that could be accessible to home users. You're certainly exposed to flaws (bugs) in lots of different software packages that could help a malicious person gain access to your files.

A user would be able to just boot the Mac holding down Opt-R to enter Recovery Mode and gain access to the files. On non-Apple Silicon systems, this access can be somewhat blocked by enabling a Firmware Password, which means that booting into Recovery Mode requires a password. However, for some older machines it is possible for Apple (and possibly others) to reset that Firmware password. On recent Intel machines, removing the Firmware Password automatically erases the contents of the disk.

On your Apple Silicon system, there's no concept of a Firmware Password as such. Instead the system automatically protects access to the Recovery Mode with your password when you have enabled File Vault.

So all in all, I would highly recommend enabling FileVault on your computer.

There's absolutely no performance impact in doing so (remember that your drive is encrypted no matter what). The main risk or concern involved in enabling FileVault is that you might forgot your password and recovery key - this can be somewhat mitigated by letting the system store a recovery key with your iCloud account.

17
  • A difference with FileVault could be if you have multiple user accounts on the Macbook. Some may be allowed to unlock FileVault while others aren't. The latter means that they have their own account, but they need an authorized user to unlock FileVault first when the computer starts. May be useful in some scenarios.
    – not2savvy
    Oct 19 at 17:36
  • Sure - but this question was about protecting against theft of the computer.
    – jksoegaard
    Oct 19 at 17:54
  • That’s why I wrote in a comment, not in a separate answer. I thought it’s nonetheless an interesting aspect.
    – not2savvy
    Oct 19 at 17:58
  • Ah yes - in that light it definitely is. I can see some home-user scenarios where that difference might come in handy!
    – jksoegaard
    Oct 19 at 20:46
  • 1
    @jksoegaard AFAIK even removing the SSD from an M1 Mac is a challenge :-) The remark was more generally regarding internal drives of non-M1 Macs
    – nohillside
    Oct 21 at 8:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .