8

I have File Vault 2 full-disk encryption enabled on my 2012 MacBook Air running Mountain Lion. By default it also has a "Guest" Safari-only account available. I just tried it the other day and found that it requires no password to boot the system and run Safari.

To my untutored eye, this seems like a major security risk to the full-disk encryption. It could be a back door to obtaining the key to decrypting the entire disk. Prior to this, I was under the impression that the disk could only be decrypted if you have a password or a recovery key. If this back door is really there, then I could imagine someone taking the SSD out of the Mac and reconstructing the process used by the Guest account to obtain the key to decrypt the disk without a password or recovery key.

So my question is: is this the risk that I perceive it might be? Or is there perhaps a separate bootable operating system on a small part of the disk with its own encryption key just for the Guest Safari access?

If it is the risk I think it is, then how do I kill the Guest access? When killing it, how do I know that it has removed all remnants of the exposure of the decryption key for the full disk?

I see from other questions that in Lion it was not possible to create such a Guest account with File Vault 2 on, but now in Mountain Lion it is there by default. Perhaps Apple has in fact made the Guest account secure. Or perhaps they left a back door open. I can't find anything about this particular question with respect to Mountain Lion in the Apple knowledge base.

Improve this question
1
  • You assume that full disk encryption encrypts the full physical disk. This is not the case - only the standard startup volume is fully encrypted. The recovery partition is not encrypted and contains a functioning Safari webbrowser. I guess that the Safari-only mode uses the recovery partition as well.
    – gentmatt
    Commented Feb 19, 2013 at 20:08

1 Answer 1

Reset to default
15

No, it's not. Some say it's a benefit if you have geo-location and remote wipe configured (or other similar software) as it increases the chance that someone finding the Mac will connect it to the Internet.

What's happening is that you also have Find My Mac on. That enables a Safari-only guest account which will allow users to log in and run Safari. The goal is that if someone steals your laptop, they might log into the guest account and give Find My Mac a chance to phone home.

The Safari-only guest account uses the unencrypted recovery partition to launch Safari. It does not decrypt your FileVault area at all, so your data remains safe.

(I've found an Apple knowledge base article confirming this.)

Improve this answer
3
  • Thanks! That KB article indeed eliminates my concern. Yes, you're right about Find My Mac being enabled. I didn't make the connection of that to the Guest account.
    – Mark Adler
    Commented Feb 19, 2013 at 20:03
  • That's basically what hiddenapp does.
    – o0'.
    Commented Aug 13, 2014 at 17:04
  • The KP article seems to be missing. Any valid link?
    – adib
    Commented Oct 30, 2018 at 10:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .