FireVault on or off

[gregpod9]

Please vote and comment on any benefits and drawbacks.

 

[Spudlicious]

I voted OFF because:

1. FileVault precludes auto login, which I like because I'm the only user of my Macs.
2. It's an added complication, something else to go horribly wrong.
3. It must use system resources = MacBook battery power.
4. It's unnecessary. Encrypt sensitive data? Sure, set a password on those files, not the whole flipping drive.
5. It's an impediment to disaster recovery. If a drive fails I don't need each and every file to be scrambled when I'm picking up the pieces.
6. If a bad actor has access to my Mac that means they're in possession of it. Are they going to send it back with a kind note and a box of chocolates when they discover the drive's encrypted?
7. I have nothing on my computers I wouldn't want the police to see, or my family to see if I drop dead.
8. I'm a cranky old guy, we like to be against everything.

Reasons for ON:

1. Addiction to porn.
2. List Ends.

But it's OFF for me

 

[Krevnik]

I voted OFF because:

1. Accurate
2. Not particularly relevant for M1 systems. FileVault is embedded into the Secure Enclave’s storage controller, and storage is always encrypted. The key difference with FileVault on vs off on an M1 is that your password is combined with the fused AES keys to decrypt drive contents.
3. Even less relevant for the same reasons as #2. There’s also acceleration hardware involved for the AES algorithm, and the internal drive is always encrypted. This has been true for Intel Macs with the T2 chip as well.
4. Because the whole drive is encrypted anyways, it could very well be less effort for the user to just enable FileVault and call it a day rather than manage individual encrypted files or disk images.
5. Technically accurate, but unfortunately not relevant for M1 or T2 Macs, because of the always-on encryption. SSDs tend to use internal encryption when writing to NAND, making recovery more difficult than HDDs to begin with. I’ve also only ever successfully recovered data once in 30 years from a failed HDD, without paying the high prices for a service to do the recovery for me. A good disaster recovery plan should always start with good backups, and drive recovery a last resort.
6. Certainly not, but it does mean that if I use my machine to conduct business, I’m not letting someone rummage through all that just because they managed to take possession of my laptop. And it prevents them from making further inroads to my accounts. Last thing I want is for someone to take my laptop and get access to my financial accounts because a cookie failed to expire in time.
7. Sure. But I don’t encrypt to keep people I trust out. Yet, encryption helps me build trust with those I do work for, by demonstrating I can be trusted with their sensitive data. When it comes to data my family needs access to if I drop dead, they already have copies of everything needed. My device isn’t going to give them anything they don’t already have (good disaster recovery practices there again).

One of the best arguments for enabling FileVault is to simply make sure that if you do misplace your device, or it is stolen, the impact to you is limited. If you do online banking, store website account passwords in your keychain, or have accounts that will send you e-mail with reset codes that are important, that’s all data useful to a bad actor. Having one take possession of your laptop can then create headaches for weeks, months, or even years down the road in the form of identity theft and fraud. And since more and more people do online banking, or have more and more vital information accessible via laptops and other devices, the risks are higher now than when they were a decade ago.

 

[Apple_Robert]

Turning on FileVault does not slowdown Macs with stock SSD. The only time you will see a hint of delay is when you reboot and have to wait a few extra seconds for the drive to unlock after logging in.

If your Mac is stolen or otherwise accessed by family, friend, or stranger in your house and you don't have FileVault turned on and engaged, it could open you up for identity theft, financial theft, account take-overs and a plethora of other problems.

 

[mj_]

On any T2-equipped Mac or any Mac with M1 SoC there really isn't any reason whatsoever to disable FileVault2. The flash drive is encrypted by default either way, whether you enable FileVault2 or not. The only thing that happens when you do enable it is that the key stored inside the secure enclave portion of the T2 chip required to decrypt the drive gets encrypted with a password of your choosing. Thus, by entering your password you are not unlocking your drive. Instead, your are decrypting the key that is then in turn used to unlock your drive. That's it.

 

[adrianlondon]

On for me on my main laptop.

Off on my old 2013 Pro with a smashed screen, as I have it connected to my TV and use a bluetooth keyboard. The drivers for the keyboard don't load until after the user/password prompt if using FileVault, and hence I can't use that keyboard to log in. So I disabled FileVault and now all the drivers I need are loaded prior to the prompt.

 

[leman]

Full disc encryption is always on with newer Macs. @Spudlicious otherwise very entertaining post is unfortunately factually wrong in this regard. The only thing that FileVault does is let you set your own password. The drawback is that you yiu are kind of screwed if you have lost your password etc.

 

[Spudlicious]

1. Accurate
2. Not particularly relevant for M1 systems. FileVault is embedded into the Secure Enclave’s storage controller, and storage is always encrypted. The key difference with FileVault on vs off on an M1 is that your password is combined with the fused AES keys to decrypt drive contents.
3. Even less relevant for the same reasons as #2. There’s also acceleration hardware involved for the AES algorithm, and the internal drive is always encrypted. This has been true for Intel Macs with the T2 chip as well.
4. Because the whole drive is encrypted anyways, it could very well be less effort for the user to just enable FileVault and call it a day rather than manage individual encrypted files or disk images.
5. Technically accurate, but unfortunately not relevant for M1 or T2 Macs, because of the always-on encryption. SSDs tend to use internal encryption when writing to NAND, making recovery more difficult than HDDs to begin with. I’ve also only ever successfully recovered data once in 30 years from a failed HDD, without paying the high prices for a service to do the recovery for me. A good disaster recovery plan should always start with good backups, and drive recovery a last resort.
6. Certainly not, but it does mean that if I use my machine to conduct business, I’m not letting someone rummage through all that just because they managed to take possession of my laptop. And it prevents them from making further inroads to my accounts. Last thing I want is for someone to take my laptop and get access to my financial accounts because a cookie failed to expire in time.
7. Sure. But I don’t encrypt to keep people I trust out. Yet, encryption helps me build trust with those I do work for, by demonstrating I can be trusted with their sensitive data. When it comes to data my family needs access to if I drop dead, they already have copies of everything needed. My device isn’t going to give them anything they don’t already have (good disaster recovery practices there again).

One of the best arguments for enabling FileVault is to simply make sure that if you do misplace your device, or it is stolen, the impact to you is limited. If you do online banking, store website account passwords in your keychain, or have accounts that will send you e-mail with reset codes that are important, that’s all data useful to a bad actor. Having one take possession of your laptop can then create headaches for weeks, months, or even years down the road in the form of identity theft and fraud. And since more and more people do online banking, or have more and more vital information accessible via laptops and other devices, the risks are higher now than when they were a decade ago.

All very fair. My bullet points were for my situ

1. Accurate
2. Not particularly relevant for M1 systems. FileVault is embedded into the Secure Enclave’s storage controller, and storage is always encrypted. The key difference with FileVault on vs off on an M1 is that your password is combined with the fused AES keys to decrypt drive contents.
3. Even less relevant for the same reasons as #2. There’s also acceleration hardware involved for the AES algorithm, and the internal drive is always encrypted. This has been true for Intel Macs with the T2 chip as well.
4. Because the whole drive is encrypted anyways, it could very well be less effort for the user to just enable FileVault and call it a day rather than manage individual encrypted files or disk images.
5. Technically accurate, but unfortunately not relevant for M1 or T2 Macs, because of the always-on encryption. SSDs tend to use internal encryption when writing to NAND, making recovery more difficult than HDDs to begin with. I’ve also only ever successfully recovered data once in 30 years from a failed HDD, without paying the high prices for a service to do the recovery for me. A good disaster recovery plan should always start with good backups, and drive recovery a last resort.
6. Certainly not, but it does mean that if I use my machine to conduct business, I’m not letting someone rummage through all that just because they managed to take possession of my laptop. And it prevents them from making further inroads to my accounts. Last thing I want is for someone to take my laptop and get access to my financial accounts because a cookie failed to expire in time.
7. Sure. But I don’t encrypt to keep people I trust out. Yet, encryption helps me build trust with those I do work for, by demonstrating I can be trusted with their sensitive data. When it comes to data my family needs access to if I drop dead, they already have copies of everything needed. My device isn’t going to give them anything they don’t already have (good disaster recovery practices there again).

One of the best arguments for enabling FileVault is to simply make sure that if you do misplace your device, or it is stolen, the impact to you is limited. If you do online banking, store website account passwords in your keychain, or have accounts that will send you e-mail with reset codes that are important, that’s all data useful to a bad actor. Having one take possession of your laptop can then create headaches for weeks, months, or even years down the road in the form of identity theft and fraud. And since more and more people do online banking, or have more and more vital information accessible via laptops and other devices, the risks are higher now than when they were a decade ago.

1. Accurate
2. Not particularly relevant for M1 systems. FileVault is embedded into the Secure Enclave’s storage controller, and storage is always encrypted. The key difference with FileVault on vs off on an M1 is that your password is combined with the fused AES keys to decrypt drive contents.
3. Even less relevant for the same reasons as #2. There’s also acceleration hardware involved for the AES algorithm, and the internal drive is always encrypted. This has been true for Intel Macs with the T2 chip as well.
4. Because the whole drive is encrypted anyways, it could very well be less effort for the user to just enable FileVault and call it a day rather than manage individual encrypted files or disk images.
5. Technically accurate, but unfortunately not relevant for M1 or T2 Macs, because of the always-on encryption. SSDs tend to use internal encryption when writing to NAND, making recovery more difficult than HDDs to begin with. I’ve also only ever successfully recovered data once in 30 years from a failed HDD, without paying the high prices for a service to do the recovery for me. A good disaster recovery plan should always start with good backups, and drive recovery a last resort.
6. Certainly not, but it does mean that if I use my machine to conduct business, I’m not letting someone rummage through all that just because they managed to take possession of my laptop. And it prevents them from making further inroads to my accounts. Last thing I want is for someone to take my laptop and get access to my financial accounts because a cookie failed to expire in time.
7. Sure. But I don’t encrypt to keep people I trust out. Yet, encryption helps me build trust with those I do work for, by demonstrating I can be trusted with their sensitive data. When it comes to data my family needs access to if I drop dead, they already have copies of everything needed. My device isn’t going to give them anything they don’t already have (good disaster recovery practices there again).

One of the best arguments for enabling FileVault is to simply make sure that if you do misplace your device, or it is stolen, the impact to you is limited. If you do online banking, store website account passwords in your keychain, or have accounts that will send you e-mail with reset codes that are important, that’s all data useful to a bad actor. Having one take possession of your laptop can then create headaches for weeks, months, or even years down the road in the form of identity theft and fraud. And since more and more people do online banking, or have more and more vital information accessible via laptops and other devices, the risks are higher now than when they were a decade ago.

All very fair. I wrote my post for my situation, with my equipment, and not too seriously.
Auto login I do value and have it on my computers other than my M1 because then it would affect touch sensor functionality. I’ve always resented having to login to my own computer, I want to just switch on and use it like a toaster or other appliance. The M1 I simply don’t power down, so I just lift the lid and touch the sensor. Obviously , anyone can turn on my iMac or MBP and access any file but the few financially sensitive ones are password protected, and I never, not once yet, take them out of the house.
Sure I rely on internet banking, but it’s just not possible to browser login to my bank (First Direct) system without using a phone with biometric ID, the passwords get so far into the system and then a time-limited access code has to be generated by the phone.
I didn’t know all M1 SSDs were encrypted anyway, but as Homer Simpson said, you can prove anything with facts!
All my data is mine alone, I finished my last job in 2011 so have no responsibility to others, if I did that would mean many changes to my security. Mind you, that last job was on contract to IBM and they didn’t rely entirely on individuals good practice, they issued an (ancient) Thinkpad and the only way to connect to their systems was via their VPN on their laptop.
When I wrote about system recovery I was probably recalling long ago times when it was easy to take a HDD from a PC and see what could be read on it with a decent set of utilities external to another PC. Not relevant to my computers of today, I accept.

Thanks for reading and responding in detail.

 

[Prince134]

I like to turn it on. BUT...
It prevents me from booting with external TB3 or USBC NVME drive with file vault turned on. I haven't found a solution yet. Is there any one tried booting from an external drive with filevault?

 

[gregpod9]

With FileVault on, can we do a clean install or is better to turn off FileVault then do a clean install?

 

[Apple_Robert]

With FileVault on, can we do a clean install or is better to turn off FileVault then do a clean install?

You can do a clean install with FV on. I have done in numerous times over the years.

 

[Prince134]

You can do a clean install with FV on. I have done in numerous times over the years.

This may not be the case in the M1. At least on external drive, you can only turn on after installation. But then the external NVME drive won't boot after FileVault turned on.

 

[Never mind]

If I could have one wish from Apple, I would like to have one knowledgeable Apple representative come and remain here to answer all our questions. Right now all we’re doing is guessing or trial and air.

 

[Maconplasma]

With FileVault on, can we do a clean install or is better to turn off FileVault then do a clean install?

You most certainly can do it with Filevault on. In fact that's mainly the point of it. If someone steals your Mac and Filevault is on the only way they can use it is to fully erase the drive and install the OS. They cannot have access to your files.

 

[winna]

On all day long