Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
FileVault 2 - Encrypted Question
- Thread starter ghsDUDE
- Start date
- Sort by reaction score
It is normal. Judging from your screenshot, you elected to allow your iCloud account to unlock your disk.
C'mon lol. Yeah, I don't remember the last line about the recovery key on my old iMac but as long as that's normal.
Looking at the screenshot above it says unlock with iCloud or get a recovery key. Can you see why I'm confused? Because I chose iCloud but it also says a recovery key has been set.
Last edited:
If you don't want recovery access, it's best to boot into disk utility and encrypt from there.
I want Recovery Access - I'm just confused. Is it normal to say Recovery Key set if I chose iCloud as my Recover method?
Yes, It's completely normal as you are in fact storing your recovery key with iCloud.
Have not turned on FileVault on a computer since 2012 (13?), so, have not tried the iCloud method.
But it appears that, yes, iCloud recovery is on. Says can recover via that route, per the dialog.
Think the dialog box is a little misleading. What is going on, from what I've seen on Apple's support site, there still is a recovery key that is generated for the drive, just that it is stored in iCloud. So, instead of you manually entering the recovery key, FileVault sign-on process extracts it from iCloud.
In the old days, worked similar in that you had the option for Apple to store the recovery key for you, but, you provided three security questions, that Apple said they only stored the questions for, not the replies. They then took the answers and melded them together to create a key to encrypt the recovery key. If you forgot the EXACT answers when you tried to recover, one was out of luck on getting that recovery key back.
This method is a little less secure, imo (if someone has access to your machine and knows your iCloud password [or provide a subpoena to Apple]), but easier for people to make their device a fair bit more secure (read: someone steals your device, this secures your data) and recover when something goes wrong.
ADD: if some concern, can always decrypt the drive and re-encrypt it, to doubly check that you did select iCloud option.
But it appears that, yes, iCloud recovery is on. Says can recover via that route, per the dialog.
Think the dialog box is a little misleading. What is going on, from what I've seen on Apple's support site, there still is a recovery key that is generated for the drive, just that it is stored in iCloud. So, instead of you manually entering the recovery key, FileVault sign-on process extracts it from iCloud.
In the old days, worked similar in that you had the option for Apple to store the recovery key for you, but, you provided three security questions, that Apple said they only stored the questions for, not the replies. They then took the answers and melded them together to create a key to encrypt the recovery key. If you forgot the EXACT answers when you tried to recover, one was out of luck on getting that recovery key back.
This method is a little less secure, imo (if someone has access to your machine and knows your iCloud password [or provide a subpoena to Apple]), but easier for people to make their device a fair bit more secure (read: someone steals your device, this secures your data) and recover when something goes wrong.
ADD: if some concern, can always decrypt the drive and re-encrypt it, to doubly check that you did select iCloud option.
Just as another data point, I intentionally told it NOT to store the recovery key on iCloud, and you can see how mine looks different than yours.
It appears both methods are creating a recovery key, just yours is stored in iCloud and mine is not.
Thanks guys - that makes sense that a recovery code has been created but it's stored in iCloud and can only be unlocked win that password.
I encrypted my old iMac and never remembered seeing that last line mentioning a recovery key has been set. That's why I was trying to see if anyone else who used iCloud also had that listed.
Thanks
Well not to throw hot water on this theory but on my 2011 MBA running 10.11.5 I elected to store my recovery key in iCloud but my FileVault tab in Security and Privacy Preferences does not show the "A recovery key has been set." verbiage (see screenshot). So I'm not sure what causes that line to show up.
Attachments
@bookemdano
Do you have Two Factor Athentification enabled? And the iCloud Keychain? Maybe it has something to do with one of those.
Could be the 2FA had to enabled before turning on FileVault. Someone mentioned the key was the answer to the security questions what you don't need anymore with enabled 2FA. So it might generate another key instead. But I don't know.
I have 2FA and iCloud Keychain enabled and see that line on my Late 2011 MBP and on my Late 2015 iMac. Can't remember if it had been there before because FileVault was disabled for a while and and I re-enabled it a few days ago.
Do you have Two Factor Athentification enabled? And the iCloud Keychain? Maybe it has something to do with one of those.
Could be the 2FA had to enabled before turning on FileVault. Someone mentioned the key was the answer to the security questions what you don't need anymore with enabled 2FA. So it might generate another key instead. But I don't know.
I have 2FA and iCloud Keychain enabled and see that line on my Late 2011 MBP and on my Late 2015 iMac. Can't remember if it had been there before because FileVault was disabled for a while and and I re-enabled it a few days ago.
On my old computer I didn't have 2FA enabled and I didn't see the recovery key line.
On my new iMac 2FA was enabled (actually, 2 Step Verification) and it looks like yours.