8 ms·

M1 Macs SSD “Encryption” trivially bypassed unless FileVault is enabled

40 points by terracatta 6y ago

TimothyBJacobs 6y ago
As mentioned in the article, FileVault is practically enabled by default during setup. IIRC you have to go out of your way not to have it enabled. > Because users are encouraged during setup to configure FileVault on new devices it is uncommon to see devices without it
- ogre_codes 6y ago
  I agree, with the caveat that it's worthwhile checking. My brand new, personal laptop has FileVault enabled, but my work laptop does not. The article title is a bit misleading regardless since it's enabled by default. Should read "Encryption is trivially bypassed if you disable FileVault"... which seems pretty obvious to most people.
  - terracatta 6y ago
    See my reply to the parent, FileVault will not be offered if you skip the iCloud setup, which many folks not wanting to mix their personal-life with their work laptop will skip.
- terracatta 6y ago
  If you skip Apple ID (which is an extremely common situation in a privacy conscious employee) you are not offered FileVault. In my experience, it's extremely common to see FileVault disabled on unmanaged workplace Macs.
angry_octet 6y ago
This is a non-issue. Submit something to osquery instead of trying to create drama.
- threatofrain 6y ago
  .
  - acdha 6y ago
    It is a non-issue: FileVault is enabled by default and while you can speculate about what would happen if Apple implemented Health storage without requiring encryption as they do on iOS that doesn't make it an issue until the unlikely event where they actually ship something which does that.
    - terracatta 6y ago
      FileVault is not offered to a user setting up their Mac to the first time if they skip iCloud. People in a work setting will often skip this step because they aren't sure... A) If they are allowed to connect their personal Apple ID to their work laptop B) If this will sync personal files to their work laptop (which might be undesirable) For personal devices, FileVault is now often on, but unmanaged devices specifically for work use? A sizable amount do not have FileVault. In the past this wasn't a big deal, but now we have tools conveying that these devices are encrypted, when in fact, their data can be trivially accessed.
      - acdha 6y ago
        Unless the defaults changed in Big Sur, it's been enabled by default with or without iCloud for many years — perhaps you're referring to the separate option to store your recovery keys on iCloud? Regarding work devices, do you have any data supporting that assertion? Even the linked article claims this is uncommon and the intersection of people who care about protecting from physical hardware access but choose to disable FileVault is pretty small. It's a good audit point but unless you have data showing this is widespread, consider whether you're doing more than pro bono marketing for Kolide.
        terracatta 6y ago
        I just wiped a new M1 device and set it up from scratch using the latest version of Big Sur. If you skip iCloud setup you are never asked to turn on FileVault. When you skip iCloud you are never told this will result in FileVault being disabled. I took photographs of the entire process if you'd like me to provide proof. I am the CEO of Kolide. An employee wrote this article because....of our customers who do not fully manage their Macs, the amount of them without FileVault can be as high as 1/3 of the entire Mac fleet. That number tracks with the UX of the setup screen I mentioned above. Esp for privacy conscious orgs.
willeh 6y ago
Encryption means speedy deletion so there is still value encrypting even if the key isn't protected. But that's probably not the reason for Apple always encrypting things with the key of the Secure Enclave. I think the reason for this design is to make the full system easier to reason about, which seems like best practice.
gruez 6y ago
I don't get it, what's the problem with this? Did Apple' marketing materials suggest otherwise (ie. your data is safe even without a password)? Also, non-apple SSDs does this as well: https://superuser.com/questions/986387/why-does-my-ssd-internally-encrypt-data-even-without-a-password-set https://superuser.com/questions/986387/why-does-my-ssd-inter...
- stefan_ 6y ago
  Kolide is a snake oil vendor, so dangerous but ultimately meaningless warnings are their business. That "you have non encrypted SSH keys" warning on their landing page is giving me shivers.
- 1_2__4 6y ago
  Why is pooh—poohing the premise of an article without offering anything other than cynicism in vogue on HN these days? The post makes pretty clear what “the problem with this is”: among other things, most notably Apple has co-opted the use of Boolean flags that previously gave an indication of whether FileVault was enabled or not to instead reflect hardware encryption status which is not the same thing at all. Which the post explains. At length.
- tyingq 6y ago
  Agree, and Apple seems to be up front about it. See the last part of https://support.apple.com/en-us/HT208344 https://support.apple.com/en-us/HT208344 "Though the SSD in computers that have the Apple T2 Security Chip is encrypted, you should turn on FileVault so that your Mac requires a password to decrypt your data." Edit: I do agree with the article's criticism of using a boolean to represent encryption status, but I don't agree with the dire sounding tone. Since you aren't entering a password, you should be aware that the key is hanging around in plaintext somewhere.
- terracatta 6y ago
  The problem is the FileVault is not enabled by default in certain situations (like if you skip iCloud setup when you first turn on a new Mac). Even though FileVault is off, popular tools like osquery will report them as "encrypted". Yes that's technically correct, but not likely what the person querying means.
93po 6y ago
Does the encryption on a Mac SSD work as powerfully as on iOS devices? My understanding is that even government agencies can't decrypt iOS devices without the user's pin and it can't be brute forced. Is that true of Macs too?

40 points by terracatta 6y ago

As mentioned in the article, FileVault is practically enabled by default during setup. IIRC you have to go out of your way not to have it enabled. > Because users are encouraged during setup to configure FileVault on new devices it is uncommon to see devices without it

ogre_codes 6y ago
I agree, with the caveat that it's worthwhile checking. My brand new, personal laptop has FileVault enabled, but my work laptop does not. The article title is a bit misleading regardless since it's enabled by default. Should read "Encryption is trivially bypassed if you disable FileVault"... which seems pretty obvious to most people.
- terracatta 6y ago
  See my reply to the parent, FileVault will not be offered if you skip the iCloud setup, which many folks not wanting to mix their personal-life with their work laptop will skip.
terracatta 6y ago
If you skip Apple ID (which is an extremely common situation in a privacy conscious employee) you are not offered FileVault. In my experience, it's extremely common to see FileVault disabled on unmanaged workplace Macs.

angry_octet 6y ago

This is a non-issue. Submit something to osquery instead of trying to create drama.

threatofrain 6y ago
.
- acdha 6y ago
  It is a non-issue: FileVault is enabled by default and while you can speculate about what would happen if Apple implemented Health storage without requiring encryption as they do on iOS that doesn't make it an issue until the unlikely event where they actually ship something which does that.
  - terracatta 6y ago
    FileVault is not offered to a user setting up their Mac to the first time if they skip iCloud. People in a work setting will often skip this step because they aren't sure... A) If they are allowed to connect their personal Apple ID to their work laptop B) If this will sync personal files to their work laptop (which might be undesirable) For personal devices, FileVault is now often on, but unmanaged devices specifically for work use? A sizable amount do not have FileVault. In the past this wasn't a big deal, but now we have tools conveying that these devices are encrypted, when in fact, their data can be trivially accessed.
    - acdha 6y ago
      Unless the defaults changed in Big Sur, it's been enabled by default with or without iCloud for many years — perhaps you're referring to the separate option to store your recovery keys on iCloud? Regarding work devices, do you have any data supporting that assertion? Even the linked article claims this is uncommon and the intersection of people who care about protecting from physical hardware access but choose to disable FileVault is pretty small. It's a good audit point but unless you have data showing this is widespread, consider whether you're doing more than pro bono marketing for Kolide.
      - terracatta 6y ago
        I just wiped a new M1 device and set it up from scratch using the latest version of Big Sur. If you skip iCloud setup you are never asked to turn on FileVault. When you skip iCloud you are never told this will result in FileVault being disabled. I took photographs of the entire process if you'd like me to provide proof. I am the CEO of Kolide. An employee wrote this article because....of our customers who do not fully manage their Macs, the amount of them without FileVault can be as high as 1/3 of the entire Mac fleet. That number tracks with the UX of the setup screen I mentioned above. Esp for privacy conscious orgs.

willeh 6y ago

Encryption means speedy deletion so there is still value encrypting even if the key isn't protected. But that's probably not the reason for Apple always encrypting things with the key of the Secure Enclave. I think the reason for this design is to make the full system easier to reason about, which seems like best practice.

gruez 6y ago

I don't get it, what's the problem with this? Did Apple' marketing materials suggest otherwise (ie. your data is safe even without a password)? Also, non-apple SSDs does this as well: https://superuser.com/questions/986387/why-does-my-ssd-internally-encrypt-data-even-without-a-password-set https://superuser.com/questions/986387/why-does-my-ssd-inter...

stefan_ 6y ago
Kolide is a snake oil vendor, so dangerous but ultimately meaningless warnings are their business. That "you have non encrypted SSH keys" warning on their landing page is giving me shivers.
1_2__4 6y ago
Why is pooh—poohing the premise of an article without offering anything other than cynicism in vogue on HN these days? The post makes pretty clear what “the problem with this is”: among other things, most notably Apple has co-opted the use of Boolean flags that previously gave an indication of whether FileVault was enabled or not to instead reflect hardware encryption status which is not the same thing at all. Which the post explains. At length.
tyingq 6y ago
Agree, and Apple seems to be up front about it. See the last part of https://support.apple.com/en-us/HT208344 https://support.apple.com/en-us/HT208344 "Though the SSD in computers that have the Apple T2 Security Chip is encrypted, you should turn on FileVault so that your Mac requires a password to decrypt your data." Edit: I do agree with the article's criticism of using a boolean to represent encryption status, but I don't agree with the dire sounding tone. Since you aren't entering a password, you should be aware that the key is hanging around in plaintext somewhere.
terracatta 6y ago
The problem is the FileVault is not enabled by default in certain situations (like if you skip iCloud setup when you first turn on a new Mac). Even though FileVault is off, popular tools like osquery will report them as "encrypted". Yes that's technically correct, but not likely what the person querying means.

93po 6y ago

Does the encryption on a Mac SSD work as powerfully as on iOS devices? My understanding is that even government agencies can't decrypt iOS devices without the user's pin and it can't be brute forced. Is that true of Macs too?