And you would also already need root for encrypting the home directory to even matter in the first place. Leaving the password on disk right next to the encrypt

And you would also already need root for encrypting the home directory to even matter in the first place. Leaving the password on disk right next to the encrypted content is on par with leaving the keys in a fancy locked safe. It completely nullifies the whole point of the added security to begin with. I'm an amateur when it comes to application security yet even I know that you should mlock() your secret data addresses and never pass secret data through command line arguments. Both trivial mistakes that Apple has made with FileVault. They even shipped code that would set the password hint to the actual password. How are their security standards so lax to have missed all of that in their encryption software alone?