4 ms·

This is a non-issue. Submit something to osquery instead of trying to create drama.

by angry_octet 6y ago

threatofrain 6y ago
.
- acdha 6y ago
  It is a non-issue: FileVault is enabled by default and while you can speculate about what would happen if Apple implemented Health storage without requiring encryption as they do on iOS that doesn't make it an issue until the unlikely event where they actually ship something which does that.
  - terracatta 6y ago
    FileVault is not offered to a user setting up their Mac to the first time if they skip iCloud. People in a work setting will often skip this step because they aren't sure... A) If they are allowed to connect their personal Apple ID to their work laptop B) If this will sync personal files to their work laptop (which might be undesirable) For personal devices, FileVault is now often on, but unmanaged devices specifically for work use? A sizable amount do not have FileVault. In the past this wasn't a big deal, but now we have tools conveying that these devices are encrypted, when in fact, their data can be trivially accessed.
    - acdha 6y ago
      Unless the defaults changed in Big Sur, it's been enabled by default with or without iCloud for many years — perhaps you're referring to the separate option to store your recovery keys on iCloud? Regarding work devices, do you have any data supporting that assertion? Even the linked article claims this is uncommon and the intersection of people who care about protecting from physical hardware access but choose to disable FileVault is pretty small. It's a good audit point but unless you have data showing this is widespread, consider whether you're doing more than pro bono marketing for Kolide.
      - terracatta 6y ago
        I just wiped a new M1 device and set it up from scratch using the latest version of Big Sur. If you skip iCloud setup you are never asked to turn on FileVault. When you skip iCloud you are never told this will result in FileVault being disabled. I took photographs of the entire process if you'd like me to provide proof. I am the CEO of Kolide. An employee wrote this article because....of our customers who do not fully manage their Macs, the amount of them without FileVault can be as high as 1/3 of the entire Mac fleet. That number tracks with the UX of the setup screen I mentioned above. Esp for privacy conscious orgs.
        acdha 6y ago
        > I am the CEO of Kolide. That seems like an important detail to have disclosed. I would recommend changing the title of that post to be less provocative and to add supporting data to it with the caveats about the selection bias behind it. It sounds like there was a regression at some point and ⅓ is definitely high enough to warrant attention but as written it sounds like clickbait to say that storage isn't encrypted when the storage encryption system is disabled. Since FileVault has always been the answer to that question, this is really more about understanding that it is still necessary and should be checked.
        terracatta 6y ago
        > It sounds like there was a regression at some point You are continually asserting incorrect information about this topic. The behavior I describe where skipping iCloud setup causes FileVault setup screen to not be shown as always been the case. There has been no regression. Source: https://derflounder.wordpress.com/2014/10/25/new-filevault-2-enablement-option-in-yosemites-setup-assistant/ https://derflounder.wordpress.com/2014/10/25/new-filevault-2...
        acdha 6y ago
        You're right about the skipped iCloud path — it's been too long since I've done that without automation (we use separate work iCloud accounts so it normally never comes up). It doesn't really change the point, though, because this isn't a bypass or flaw in the encryption system but a gap in the initial setup flow. It's an important audit point and definitely good to surface for your customers but it's not exactly a surprise that if you don't enable storage encryption, you don't have encrypted storage. I know that there's a long history of attention-seeking blog posts from companies selling products but you're trying to make a reputation as an honest security company and I think that marketing is a key component of that.
- spijdar 6y ago
  You have to be pretty blatant and intentional to disable encryption, if you just coast through then FileVault will be enabled, at least as I understand. Another perspective is it's great Apple doesn't force encryption 100% of the time. There are situations where you wouldn't want it -- very niche ones, granted, but I think the choice is a good thing.
  - threatofrain 6y ago
    .
    - my123 6y ago
      Your iPhone is unencrypted in that same sense when you don't have the passcode set.
    - spijdar 6y ago
      I'd say yes, albeit only if it's "available" and not something you could accidentally enable, or could be enabled through sabotage. Having an unencrypted device could make it easier to reverse-engineer, improving consumer control and ownership of the device. Obviously not really Apple's shtick, but I think the choice is good, so long as you have to very specifically ask to disable encryption.
- ogre_codes 6y ago
  > There is no setup question for the user to have an unencrypted iPhone. The Mac has a lot of options you don't have on the iPhone, starting with what operating system you want to run. One of the reasons the iPhone and iPad are popular is because they take away a lot of decisions (aka options) which make computers intimidating.

This is a non-issue. Submit something to osquery instead of trying to create drama.

threatofrain 6y ago

acdha 6y ago
It is a non-issue: FileVault is enabled by default and while you can speculate about what would happen if Apple implemented Health storage without requiring encryption as they do on iOS that doesn't make it an issue until the unlikely event where they actually ship something which does that.
- terracatta 6y ago
  FileVault is not offered to a user setting up their Mac to the first time if they skip iCloud. People in a work setting will often skip this step because they aren't sure... A) If they are allowed to connect their personal Apple ID to their work laptop B) If this will sync personal files to their work laptop (which might be undesirable) For personal devices, FileVault is now often on, but unmanaged devices specifically for work use? A sizable amount do not have FileVault. In the past this wasn't a big deal, but now we have tools conveying that these devices are encrypted, when in fact, their data can be trivially accessed.
  - acdha 6y ago
    Unless the defaults changed in Big Sur, it's been enabled by default with or without iCloud for many years — perhaps you're referring to the separate option to store your recovery keys on iCloud? Regarding work devices, do you have any data supporting that assertion? Even the linked article claims this is uncommon and the intersection of people who care about protecting from physical hardware access but choose to disable FileVault is pretty small. It's a good audit point but unless you have data showing this is widespread, consider whether you're doing more than pro bono marketing for Kolide.
    - terracatta 6y ago
      I just wiped a new M1 device and set it up from scratch using the latest version of Big Sur. If you skip iCloud setup you are never asked to turn on FileVault. When you skip iCloud you are never told this will result in FileVault being disabled. I took photographs of the entire process if you'd like me to provide proof. I am the CEO of Kolide. An employee wrote this article because....of our customers who do not fully manage their Macs, the amount of them without FileVault can be as high as 1/3 of the entire Mac fleet. That number tracks with the UX of the setup screen I mentioned above. Esp for privacy conscious orgs.
      - acdha 6y ago
        > I am the CEO of Kolide. That seems like an important detail to have disclosed. I would recommend changing the title of that post to be less provocative and to add supporting data to it with the caveats about the selection bias behind it. It sounds like there was a regression at some point and ⅓ is definitely high enough to warrant attention but as written it sounds like clickbait to say that storage isn't encrypted when the storage encryption system is disabled. Since FileVault has always been the answer to that question, this is really more about understanding that it is still necessary and should be checked.
        terracatta 6y ago
        > It sounds like there was a regression at some point You are continually asserting incorrect information about this topic. The behavior I describe where skipping iCloud setup causes FileVault setup screen to not be shown as always been the case. There has been no regression. Source: https://derflounder.wordpress.com/2014/10/25/new-filevault-2-enablement-option-in-yosemites-setup-assistant/ https://derflounder.wordpress.com/2014/10/25/new-filevault-2...
        acdha 6y ago
        You're right about the skipped iCloud path — it's been too long since I've done that without automation (we use separate work iCloud accounts so it normally never comes up). It doesn't really change the point, though, because this isn't a bypass or flaw in the encryption system but a gap in the initial setup flow. It's an important audit point and definitely good to surface for your customers but it's not exactly a surprise that if you don't enable storage encryption, you don't have encrypted storage. I know that there's a long history of attention-seeking blog posts from companies selling products but you're trying to make a reputation as an honest security company and I think that marketing is a key component of that.
spijdar 6y ago
You have to be pretty blatant and intentional to disable encryption, if you just coast through then FileVault will be enabled, at least as I understand. Another perspective is it's great Apple doesn't force encryption 100% of the time. There are situations where you wouldn't want it -- very niche ones, granted, but I think the choice is a good thing.
- threatofrain 6y ago
  .
  - my123 6y ago
    Your iPhone is unencrypted in that same sense when you don't have the passcode set.
  - spijdar 6y ago
    I'd say yes, albeit only if it's "available" and not something you could accidentally enable, or could be enabled through sabotage. Having an unencrypted device could make it easier to reverse-engineer, improving consumer control and ownership of the device. Obviously not really Apple's shtick, but I think the choice is good, so long as you have to very specifically ask to disable encryption.
ogre_codes 6y ago
> There is no setup question for the user to have an unencrypted iPhone. The Mac has a lot of options you don't have on the iPhone, starting with what operating system you want to run. One of the reasons the iPhone and iPad are popular is because they take away a lot of decisions (aka options) which make computers intimidating.