2

(editing this question for clarity)

Assume that a Mac (with Apple Silicon) is physically given to a non-admin user (say a child).

Pre-condition:

  1. The non-admin user does not know the admin password and the AppleId used to activate the Mac.
  2. Filevault is turned on.
  3. The user has restricted access on the Mac that they wish to bypass.

The user can follow this process:

  1. Press and hold the power button while the Mac is starting.
  2. This gives the user two options - to use Startup Options or continue to boot.
  3. The user selects Startup Options.
  4. The user is booted into Recovery mode and asked to enter the admin password to continue.
  5. Since the user doesn’t know the admin password they select: File -> Erase Mac.
  6. This does not ask for any password and proceeds to delete the OS requiring a reinstall.

As long as there is an appleId which is activated that the user does not know and FileVault is enabled they cannot take full control of the Mac. However it creates two problems:

  1. Any data not backed up on the device is lost.
  2. The OS has to be reinstalled and restrictions recreated (which is a nuisance).

The question is if a user can be prevented from using the above method and if so how.

Please provide a technical answer without using analogies like liquor cabinets and door locks.

12
  • 4
    Backups are the defence against data loss. Security is about preventing your data from being read by others. Erased data cannot be read. Is your son able to comprehend that this is not a useful thing to do?
    – benwiggy
    Commented May 5, 2023 at 6:43
  • 3
    I suspect the solution to the problem may not be a technical one.
    – benwiggy
    Commented May 5, 2023 at 11:22
  • 1
    @KostubDeshmukh And why/how does your son have access to your phone? You have a social problem, not a technological one. Commented May 5, 2023 at 20:45
  • 2
  • 3
    From the comments…you’ve basically asking “how do I remove the door lock because it appears to be a security hole because my neighbors keep coming in to drink my beers despite me locking the doors in spite of the fact I gave them the keys and alarm code” You have a behavioral problem, not a technical one.
    – Allan
    Commented May 10, 2023 at 16:06

1 Answer 1

2
+25

How do you disable this [Erase Mac] option? It seem like a security hole for a mac which is given to a non admin user.

This cannot be disabled.

Recovery, especially modern versions, are downloaded over the Internet. It’s an immutable, stripped down version of macOS designed to have a small footprint. When you boot this version, you aren’t booting from the regular volume where all your apps and settings are.

As such, there’s quiet literally nothing you can do to disable that feature. Even if, hypothetically speaking, you could modify the UI that boots from the recovery partition and disable it, all that would be necessary to bypass that change is to boot an installer image from Internet or from USB; those changes would be moot.

Don’t share your admin credentials

The reason you have this issue is that you’ve given the ability to authenticate as an admin to a non-admin. This is like the bank manager writing the combination to the vault on the whiteboard where the customers can see. It not secure if you give access away.

Add an activation lock that will prevent access to recovery (what it was designed for) and keep your admin password and 2FA trusted device secure.

TL;DR

Apple has provided a way to secure your Mac from being taken over with things like Activation Lock secured with advanced tools like 2FA. Booting to Recovery is impossible if these are security functions implemented. However, they aren’t useful if you give away your authentication credentials, even to your child.

To put it another way…

If you want to keep your child out of the liquor cabinet, you can’t lock it, then claim it’s not secure because you gave them the key.

11
  • @Thinkr - Definition of moot = having little or no practical relevance. In other words, even if you could make the modification, the result would mean nothing.
    – Allan
    Commented May 10, 2023 at 18:52
  • 1
    So what is the alternative? How is that anyone with physical access to the laptop can simply erase the contents without any checks? At the very least you should be asked for the admin password. Commented May 11, 2023 at 20:11
  • 2
    It has checks. You just bypassed them. I wish I could give you better news, but in the end you have to secure your authentication devices from your child
    – Allan
    Commented May 11, 2023 at 22:33
  • 1
    The admin password, your Apple ID and 2FA. I don’t know how to explain this any further. It’s not Apple’s fault if you give away your credentials.
    – Allan
    Commented May 15, 2023 at 12:26
  • 1
    Allan, you just seem to simply give analogies and not straightforward answers. The admin password does not lock the recovery mode and Erase Mac option. You can simply click Erase Mac by booting into recovery mode and clicking Erase Mac without entering any password. If there is a way to do it then please explain how technically, not using some liquor cabinet analogy. Commented May 16, 2023 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .