Do you encrypt drives on desktop computers that always stay at home?

[VitoBotta]

We have two M1 minis (16/256 and 8/512) plus several external drives. I have always encrypted everything even at home but I wonder about the performance impact. I live in Finland where crime is low, so I am wondering whether I could just do without encryption for devices that stay at home (I have a MacBook that is fully encrypted and will stay that way of course).

What do you do? Do you encrypt also devices that stay at home?

 

[KaliYoni]

We have two M1 minis (16/256 and 8/512) plus several external drives. I have always encrypted everything even at home but I wonder about the performance impact. I live in Finland where crime is low, so I am wondering whether I could just do without encryption for devices that stay at home (I have a MacBook that is fully encrypted and will stay that way of course).

What do you do? Do you encrypt also devices that stay at home?

All of my Macs have FileVault turned on for many reasons, including:

• They are connected to the Internet and have multiple macOS user accounts set up.
• Confidential and private data is stored on them.
• If my house was ever burglarized, I wouldn't have to deal with a potential data breach on top of all of the other problems that would be created.
• Current processors, memory, and storage are all fast enough that I don't notice any effects on performance.

I maintain redundant backups (Time Machine and Carbon Copy Cloner) at all times as a safety net.

 

[NoBoMac]

We have two M1 minis (16/256 and 8/512)

What do you do? Do you encrypt also devices that stay at home?

In this case, question is somewhat moot as the M-based Macs encrypt files. No on/off switch for that.

At this point, turn on FileVault as that will secure the drive's encryption keys within the Secure Enclave and will prevent someone from booting the machine (and getting at data) without unlocking it via a user password. With out FileVault, once the machine is booted, the drive is decrypted.

 

[Gudi]

Do you encrypt also devices that stay at home?

FileVault 2 is activated by default on every Mac and M-series chips have a special hardware logic to accelerate encrypt and decrypt operations and store passwords and biometric data in a security enclave.

Don’t worry and don’t change any settings!

 

[beach bum]

Yup, I encrypt everything... even my backups are encrypted along with all external drives. In all of the years that I've been doing this, I have not noticed any negative impact on my devices.

 

[russell_314]

We have two M1 minis (16/256 and 8/512) plus several external drives. I have always encrypted everything even at home but I wonder about the performance impact. I live in Finland where crime is low, so I am wondering whether I could just do without encryption for devices that stay at home (I have a MacBook that is fully encrypted and will stay that way of course).

What do you do? Do you encrypt also devices that stay at home?

I always encrypt my drives. I don’t think the internal drives would have any performance hit, but perhaps your external drives might. I guess it would depend on what you have on them. If it’s nothing private then maybe leave them unencrypted.

The way I look at it is it’s part of good computing practices. Sure the chances of your external drives being stolen are probably extremely low but it’s possible and is it worth taking the risk for some very slight benefit. It’s the same thing was making a back up of your information. The chances of losing your data are very low but it’s possible so it’s a good idea.

 

[russell_314]

FileVault 2 is activated by default on every Mac and M-series chips have a special hardware logic to accelerate encrypt and decrypt operations and store passwords and biometric data in a security enclave.

Don’t worry and don’t change any settings!

With the internal SSD, even if it wasn’t encrypted would it be possible to access the data? The SSD is soldered to the motherboard so short of desoldering it I wonder if it’s possible. Could someone hook up the Mac to another Mac and access the SSD if file vault was disabled?

 

[IngoX]

Could someone hook up the Mac to another Mac and access the SSD if file vault was disabled?

Yes, using target disk mode i guess this would be possible without FileVault enabled. The internal disk is encrypted with a hardware key on all Apple silicon and T2 Intel macs but with FileVault enabled decryption can´t be done without the user password.

The good news is that enabling FileVault has no additional performance cost at all!
Some good reading by Howard Oakley:

Why you should enable FileVault

T2 and Apple silicon Macs always encrypt the Data volume in internal storage. So why bother with enabling FileVault? And can you do that on external bootable disks?

eclecticlight.co

... plus several external drives. I have always encrypted everything even at home but I wonder about the performance impact.

For external disks if you use APFS Encrypted you can get a minor performance impact. For storage probably not noticable, maybee a consideration if you use it for video-editing. In Oakleys experiments the performance cost could vary not only from type and make of disk, but also from how it was connected.

What’s the overhead of using APFS encryption?

Is the performance overhead of using APFS Encrypted volumes to store sensitive data a reason for not doing so?

eclecticlight.co

 

[iamasmith]

Really the any overhead from the encryption is probably negligible with hardware often able to assist with this kind of encryption. Think about a few years down the line where you might want to get rid of the device or scrap it too though because being able to destroy the encryption keys and that your data is effectively scrambled is definitely a plus - I would not rely on secure erase for flash drives for the reason of data being left behind in the extra capacity these devices set aside for wear levelling.

 

[chrfr]

Really the any overhead from the encryption is probably negligible with hardware often able to assist with this kind of encryption.

For T2 and Apple Silicon Macs, there is no additional overhead for turning on encryption on internal storage as the data written to disk is always encrypted. Turning on FileVault just adds the requirements for user credentials to decrypt the data.
There are lengthy details here: https://support.apple.com/guide/deployment/intro-to-filevault-dep82064ec40/web

 

[dotatoc]

Yes.

 

[Fishrrman]

I don't encrypt much of anything.

Only exceptions:
One partition on a drive I keep in my car as an "off-site backup". That partition has bank records, etc. There are 3 other partitions WITHOUT encryption -- just don't need it.

Other exception:
A very small encrypted disk image I keep on my MacBook Pro. It has a file with stored passwords on it. Nothing else.

No other drive I own (numerous drives) have any encryption at all.
In a "moment of need", I WANT things to be "easy to access".

 

[avz]

Yes I did it with my 27 inch Late 2012 iMac which I already sold. The idea is that you should encrypt your device if you are likely to sell it down the road. The chance of it being stolen only reinforces an already strong case for the encryption and if your device has an SSD formatted as APFS makes it a no brainer due to its insane speed.

 

[ignatius345]

I had a Mac that "always stayed at home" not stay at home anymore after I was burglarized. So yeah, everything is encrypted all the time.