5 ms·

Macbook Pro running El Capitan. The firmware is password locked so no one can change the boot disk, the SSD, Samsung 840 Pro, is encrypted with FileVault2. I a

by yardie 10y ago

Macbook Pro running El Capitan. The firmware is password locked so no one can change the boot disk, the SSD, Samsung 840 Pro, is encrypted with FileVault2. I also have guest access enableD to entice the unauthorised user to login and connect to the internet. Where I can lock or nuke the laptop using iCloud. One thing I missed about the old OpenFirmware Macs was that you could personalise a message into the firmware boot screen like, "Call me: +1 305 555 222 for a reward!" The current FileVault login page has no such option.

Razengan 10y ago
> One thing I missed about the old OpenFirmware Macs was that you could personalise a message into the firmware boot screen like, "Call me: +1 305 555 222 for a reward!" The current FileVault login page has no such option. Although not quite the boot screen, you can set a message on the user login screen, from System Preferences -> Security & Privacy -> Show a message when the screen is locked. Also of course set it to require password after 1 minute or less after going to sleep (and going to sleep after a reasonable period of inactivity; I have mine set to 5 minutes) and disable automatic login.
cookiemonsta 10y ago
"The firmware is password locked" - how did you enable this?
- sigjuice 10y ago
  https://support.apple.com/en-us/HT204455 https://support.apple.com/en-us/HT204455
  - bitserf 10y ago
    how is an Apple service provider able to bypass this? if they can, so can an adversary, no?
bedrovesen 10y ago
Whats this guest access enableD you speak of? Sounds useful
- 0942v8653 10y ago
  System Preferences > Users & Groups > Guest User > Allow guests to log onto this computer "If FileVault is turned on guest users can only access Safari."
  - bedrovesen 10y ago
    Okay thanks. I always have file vault on so guess I already have this one
eeeeeeeeeeeee 10y ago
So is the guest user only for when you leave the machine powered on? Just seems like the firmware password conflicts with the idea of the guest account. I have gone back and forth on whether or not to enable the guest user. On one hand, it feels like giving an attacker another potential entry point to escalate privileges.

by yardie 10y ago

Razengan 10y ago

> One thing I missed about the old OpenFirmware Macs was that you could personalise a message into the firmware boot screen like, "Call me: +1 305 555 222 for a reward!" The current FileVault login page has no such option. Although not quite the boot screen, you can set a message on the user login screen, from System Preferences -> Security & Privacy -> Show a message when the screen is locked. Also of course set it to require password after 1 minute or less after going to sleep (and going to sleep after a reasonable period of inactivity; I have mine set to 5 minutes) and disable automatic login.

cookiemonsta 10y ago

"The firmware is password locked" - how did you enable this?

sigjuice 10y ago
https://support.apple.com/en-us/HT204455 https://support.apple.com/en-us/HT204455
- bitserf 10y ago
  how is an Apple service provider able to bypass this? if they can, so can an adversary, no?

bedrovesen 10y ago

Whats this guest access enableD you speak of? Sounds useful

0942v8653 10y ago
System Preferences > Users & Groups > Guest User > Allow guests to log onto this computer "If FileVault is turned on guest users can only access Safari."
- bedrovesen 10y ago
  Okay thanks. I always have file vault on so guess I already have this one

eeeeeeeeeeeee 10y ago

So is the guest user only for when you leave the machine powered on? Just seems like the firmware password conflicts with the idea of the guest account. I have gone back and forth on whether or not to enable the guest user. On one hand, it feels like giving an attacker another potential entry point to escalate privileges.