17

I am new to the Mac and was setting up my Time Machine. However, it seems Time Machine also backs up information in the keychain.

I was wondering if that means I should use an encrypted disk to store Time Machine backups. (assuming that the rest of the data on my Mac isn't that sensitive, to warrant encrypting the disk otherwise. But my passwords to login into various accounts, I don't want falling into wrong hands)

At the same time, I have read in some forums that encrypting backups sorta defeats the purpose - since that means I might not be able to access my backed up data when I need it. This is one such forum discussion. (The discussion also seemed to imply that if something goes wrong, getting back my data from an encrypted disk might be hard even if I know the encryption password. Is that true?)

Also, is performance a concern when using encrypted backups, assuming encryption is recommended? From what I understand, since the CPU is much faster than the disk, there should be no real performance hit. Yet, I have read on forums that Time Machine becomes really slow if encryption is turned on. Again, is this true?

Finally, if an unencrypted Time Machine backup disk falls into the wrong hands, will my keychain data be accessible to only if the finder knows my Mac OS X password? Or are there ways to get that information even otherwise?

TL;DR

Is encryption recommended for Time Machine backups, assuming a very basic need for security of data from falling into wrong hands. In particular, I would like to restrict access to my keychain data using encryption, but only if it doesn't compromise my ability to access the backups when I really NEED them, and there isn't a major performance hit.

Improve this question
3
  • 4
    Maybe we should split this question into three questions. It looks to me like we have: "Is TM encrypted backups harder to restore?"; "Are TM encrypted backups significantly slower than non-encrypted?"; "Is it necessary to encrypt a backup to protect keychain access?". Here, Q&As work better when it is one concise question.
    – bassplayer7
    Feb 8, 2013 at 13:37
  • That makes sense :) Can I do this myself, or is is it something an admin should do?
    – Himanshu P
    Feb 8, 2013 at 13:42
  • 1
    You can do that by your self. There is an "edit" link under the question (above comments), that you can use to trim this question down. Then, research, and ask the separate questions, as comprehensive autonomous questions (you could link to your other questions, if needed).
    – bassplayer7
    Feb 8, 2013 at 13:46

1 Answer 1

Reset to default
14

To answer your first question about the keychain and whether you should encrypt backups: the passwords in your keychain are already encrypted, that's why you always have to type a password (by default your login password) to show stored passwords. So there's no immediate need to encrypt.

Of course, you could add Time Machine encryption to provide a further layer of security. This is possible starting with OS X Lion and Mountain Lion (from http://support.apple.com/kb/ht1427):

OS X Lion and Mountain Lion let you encrypt the Time Machine backup external drive using FileVault 2.

FileVault2 also uses your login password, though. So if the bad guys are able to guess or crack that password, they will have also access to your keychain information. Choosing different passwords for login and for accessing your keychain would protect the keychain passwords in such an event.

Either way, use strong passwords, password quality is of foremost importance to protect your data.

EDIT:

The OP asked in a comment how to set different passwords for login and keychain. Here is how:

  • Open Utilities>Keychain Access.

  • Right click each keychain and select 'Change Password for Keychain XYZ':

    enter image description here

If you prefer to use your current password as keychain password and change your login password, log in using another account and change your account's password from System Preferences>Users & Groups. That will only change your login password, not your keychain password.

Improve this answer
5
  • +1 I did not know that I could choose different passwords for login and the keychain. How would I do that (the key chain preferences seem a bit complicated)?
    – Himanshu P
    Feb 15, 2013 at 10:25
  • Have a look to my answer, I edited it to explain how to set different passwords.
    – jaume
    Feb 15, 2013 at 10:42
  • 2
    If the external drive that you are backup up to with Time Machine is already encrypted, then is Time Machine with encryption adding another encryption on top, which would seem like a waste of effort (slowing things down)? IE if you have an encrypted external drive, should you then select "encrypt" with Time Machine as well, or not? Thanks!
    – GreenAsJade
    Jan 3, 2014 at 23:29
  • I guess Time Machine would, as you say, encrypt the data and copy it to the already encrypted filesystem. I would only select it if the backup contained very sensitive data (disclaimer: I'm not a security expert - there may be better ways of protecting your data.) Longer backup time is the price to pay, that's the tradeoff, but as Time Machine works in the background you shouldn't bother much about that as long as you don't do any CPU intensive work while the backup runs.
    – jaume
    Jan 4, 2014 at 14:26
  • also, encryption only makes sense if using a strong password. weak passwords can be quickly bruteforced.
    – Display Name
    May 11, 2015 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .