File Vault Encryption Options

[Alpha Centauri]

Hi all,

I received back my repaired 2023 MBP, basically all was replaced except the lower cover. I'm all up and running with my data and Apps.

Last set up I kind of rushed through the prompts of encrypting the File Vault but would this time want to give it some thought.

Afak the options are 1. using a physical recovery key or allowing 2. iCloud to unlock it and noting down the generated key, 3. generating ones own password altogether.

I won't be buying Yubikey. Am I right in assuming that the if I was choosing option 3, then the account/ log-in password must be different to the one activated with File Vault?

What do you guys do? Would love some pros and cons.

Cheers

Protect data on your Mac with FileVault

Turn on FileVault to add an extra layer of security to the encrypted data on your Mac.

support.apple.com

 

[chabig]

Your understanding of the two FileVault choices is a bit off. One choice is to let iCloud keep the credentials (protected by your AppleID) necessary to decrypt the SSD. The second choice is not a hardware key, it's just a string of letters and numbers that you have to save securely somewhere.

There is no option to generate your own FileVault recovery key. With FileVault enabled, your user account password protects the SSD's volume encryption key. The article you linked is correct. Here is another one that might help shed some light:

Why you should enable FileVault

T2 and Apple silicon Macs always encrypt the Data volume in internal storage. So why bother with enabling FileVault? And can you do that on external bootable disks?

eclecticlight.co