6 ms·
> Filevault and by extension Touch ID are more or less crippled Sorry, what does this sentence mean? That someone with physical access to my machine can now un
by peteretep 6y ago
> Filevault and by extension Touch ID are more or less crippled
Sorry, what does this sentence mean? That someone with physical access to my machine can now unencrypt my FileVault encrypted hard drive?
- deepstack 6y agoSome one from Apple, I'm sure you read this. Please answer this ASAP. I rely on mac and FileValute for professional use at work. Need to know the state of this exploit.
- m1gu3l 6y agolol good luck and god bless with all that.
- pstadler 6y agoBow for the chosen one!
- devenblake 6y ago> I rely on Mac and FileVault for professional use ... then phase out your use, because proprietary systems will always get cracked given enough time.
- acdha 6y agoGood point, let’s switch to unbreakable open source systems based on OpenSSL instead. This kind of advocacy is not only unhelpful but actually counterproductive
- tedunangst 6y agoSoftware encryption is very often much easier to rotate than integrated solutions. When all the TPM chips were broken, Windows stopped using them for BitLocker, but didn't reencrypt any of the affected disks. They're just as vulnerable as they were.
- acdha 6y agoSoftware encryption is also harder to protect without a trusted boot path. My point was just that this isn't a simple binary decision but rather something which requires review and defense in depth.
- parliament32 6y ago>FileVault for professional use Probably not the best choice :) you never want to use proprietary software if security is a concern
- duhi88 6y agoWhat is a non-proprietary solution for full-disk encryption?
- williamscales 6y agoluks
- centimeter 6y agoluks or zfs.
- aborsy 6y agoOr Veracrypt.
- blacklion 6y agoI want not note, that ZFS is not full disk encryption. ZFS native encryption was designed to allow secure backups via "zfs send | zfs receive" mechanism, so it encrypt only data blocks, and not metadata. LUKS and GEIL are full-disk encryption systems, and if you need FDE, you must use them under ZFS, not ZFS native encryption.
- plussed_reader 6y agoWouldn't this mean the 'secure' values for these two processes within are now visible/ readable with the right tool/protocol availability?
- akvadrako 6y agoThe Secure Enclave on the T2 chip was used to store secrets that were supposed to stay inaccessible, even to someone with physical access. If you use a strong password to encrypt your drive you should still be safe, unless Apple did something really stupid. The password is used as a one-way hash to generate the key. However if you can login with Touch ID and they find a way to use known SE exploits, it's compromised. Your fingerprint isn't a secret that gets hashed – instead it's verified by the SE which also holds the secret key for the drive.
- jonny_eh 6y agoIsn't a password always required to decrypt on a cold boot?
- RussianCow 6y agoYes, but that doesn't help you if someone steals your MacBook when it's asleep.
- easton 6y agoSomeone would have to DFU your laptop before hand and jailbreak the chip, since booting into DFU requires shutting the system down.