M1 Macs SSD “Encryption” trivially bypassed unless FileVault is enabled

https://blog.kolide.com/modern-macs-still-need-filevault-d5e2f55c083b

by terracatta • 6 years ago

40 26 6 years ago

blog.kolide.com

As mentioned in the article, FileVault is practically enabled by default during setup. IIRC you have to go out of your way not to have it enabled.

Because users are encouraged during setup to configure FileVault on new devices it is uncommon to see devices without it

ogre_codes2• 6 years ago

I agree, with the caveat that it's worthwhile checking.

My brand new, personal laptop has FileVault enabled, but my work laptop does not. The article title is a bit misleading regardless since it's enabled by default. Should read "Encryption is trivially bypassed if you disable FileVault"... which seems pretty obvious to most people.

terracatta7• 6 years ago

See my reply to the parent, FileVault will not be offered if you skip the iCloud setup, which many folks not wanting to mix their personal-life with their work laptop will skip.

terracatta7• 6 years ago

If you skip Apple ID (which is an extremely common situation in a privacy conscious employee) you are not offered FileVault.

In my experience, it's extremely common to see FileVault disabled on unmanaged workplace Macs.

angry_octet• 6 years ago

This is a non-issue. Submit something to osquery instead of trying to create drama.

threatofrain2• 6 years ago

acdha5• 6 years ago

It is a non-issue: FileVault is enabled by default and while you can speculate about what would happen if Apple implemented Health storage without requiring encryption as they do on iOS that doesn't make it an issue until the unlikely event where they actually ship something which does that.

spijdar2• 6 years ago

You have to be pretty blatant and intentional to disable encryption, if you just coast through then FileVault will be enabled, at least as I understand.

Another perspective is it's great Apple doesn't force encryption 100% of the time. There are situations where you wouldn't want it -- very niche ones, granted, but I think the choice is a good thing.

ogre_codes2• 6 years ago

There is no setup question for the user to have an unencrypted iPhone.

The Mac has a lot of options you don't have on the iPhone, starting with what operating system you want to run. One of the reasons the iPhone and iPad are popular is because they take away a lot of decisions (aka options) which make computers intimidating.

willeh• 6 years ago

Encryption means speedy deletion so there is still value encrypting even if the key isn't protected. But that's probably not the reason for Apple always encrypting things with the key of the Secure Enclave. I think the reason for this design is to make the full system easier to reason about, which seems like best practice.

gruez• 6 years ago

I don't get it, what's the problem with this? Did Apple' marketing materials suggest otherwise (ie. your data is safe even without a password)? Also, non-apple SSDs does this as well: https://superuser.com/questions/986387/why-does-my-ssd-inter...

stefan_• 6 years ago

Kolide is a snake oil vendor, so dangerous but ultimately meaningless warnings are their business. That "you have non encrypted SSH keys" warning on their landing page is giving me shivers.

tyingq• 6 years ago

Agree, and Apple seems to be up front about it.

See the last part of https://support.apple.com/en-us/HT208344

"Though the SSD in computers that have the Apple T2 Security Chip is encrypted, you should turn on FileVault so that your Mac requires a password to decrypt your data."

Edit: I do agree with the article's criticism of using a boolean to represent encryption status, but I don't agree with the dire sounding tone. Since you aren't entering a password, you should be aware that the key is hanging around in plaintext somewhere.

terracatta7• 6 years ago

The problem is the FileVault is not enabled by default in certain situations (like if you skip iCloud setup when you first turn on a new Mac). Even though FileVault is off, popular tools like osquery will report them as "encrypted".

Yes that's technically correct, but not likely what the person querying means.

93po• 6 years ago

Does the encryption on a Mac SSD work as powerfully as on iOS devices? My understanding is that even government agencies can't decrypt iOS devices without the user's pin and it can't be brute forced. Is that true of Macs too?

M1 Macs SSD “Encryption” trivially bypassed unless FileVault is enabled

Related Stories