4

I've been happily using Legacy FileVault on my Macbook since I upgraded from Snow Leopard to Lion. Today, I decided to switch to FileVault 2 and went ahead and clicked the "Turn On FileVault" button. Everything progressed as described in the Apple OS X Lion: About FileVault 2 support document.

However, I didn't turn off Legacy FileVault before doing this and was never prompted to do so by the FileVault 2 process.

Having let the process complete, all seems well. However, Legacy FileVault is still enabled for my home folder as confirmed by the fact that its still turned on in System Preferences ➔ Security and its also still pointing to /Users/.binarybob/binarybob.sparsebundle. I'm assuming there's now a double-encryption in effect for both the entire disk and also my home folder.

So, is it safe to turn off Legacy FileVault now?

Improve this question

1 Answer 1

Reset to default
2

You are correct with your assumption that there is a "double-encryption" occurring. This of course has the result of causing a lot of drive thrashing to occur. Having previously had to fix numerous corrupt FileVaults, I would first back up the sparsebundle. Once that is complete, I would then disable Legacy FileVault.

Ultimately, the only real reason to maintain this setup is if there is reason to suspect there are others who possess login credentials (especially admin credentials) and are capable of mischievous behavior. Even under that scenario, my recommendation would be to encrypt the files which need to be kept secret using TrueCrypt and disable Legacy FileVault.

Improve this answer
4
  • To add to DMan's answer, if you don't want to encrypt files individually, you could create encrypted disk image (Disk Utility in Utilities, then choose New Image and choose something other than 'none' for Encryption). Obviously make sure to remember the password (it could also be stored in the Keychain if I remember correctly).
    – lupincho
    May 15, 2012 at 7:22
  • Also a viable option and yes the keychain could be set to remember the password.
    – DMan
    May 15, 2012 at 7:49
  • @DMan Thanks for the answer! Actually, there isn't a lot of disk thrashing going on. It's seemingly not that worse, in terms of performance, than it was with only Legacy FileVault turned on! Also, as FileVault 2 and Legacy FileVault used the same password by default then surely "mischievous" individuals would have access to both? (I don't recall having to specify a different password for Legacy FileVault when I enabled it)
    – binarybob
    May 15, 2012 at 8:07
  • To clarify regarding "mischievous individuals" remark: With FileVault 2 (or without any version of FileVault enabled), if an individual had an admin level account, one could modify the file system owner & group permissions to gain access to directories within your home folder. However, if your home folder was contained within an encrypted sparsebundle as is the case with home directories created with Mac OS 10.6, permissions could be changed, but access would not be granted until a valid pass phrase was entered.
    – DMan
    May 15, 2012 at 8:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .