3 ms·

If you're on OS X Lion, you should be using FileVault for whole disk encryption. Enabling FileVault automatically disables Firewire/Thunderbolt DMA access whil

by there 14y ago

If you're on OS X Lion, you should be using FileVault for whole disk encryption. Enabling FileVault automatically disables Firewire/Thunderbolt DMA access while the screen is locked. You can also tweak a setting to automatically erase the FileVault key before suspending the laptop, requiring it to be entered before booting back up: pmset -a destroyfvkeyonstandby 1 I use pmset -a destroyfvkeyonstandby 1 hibernatemode 25 to always hibernate the laptop instead of suspending. The FileVault key is erased and the memory is dumped to disk encrypted.

wgx 14y ago
You can also disable target disk mode and add a firmware password to prevent a thief from booting the machine to any other disk, even removable media. http://support.apple.com/kb/HT1352 http://support.apple.com/kb/HT1352 edit: added Apple link.
- nieve 14y ago
  Note that the firmware password can be bypassed by any Apple tech who calls into their call center, identifies themselves, and requests it. It's defense against a casual thief, but not someone with Apple connections, LEA, or any of thousands of Apple employees and third-party repair places. Still worth doing, just not as secure as the ones on old IBM thinkpads, say.
  - voltagex_ 14y ago
    I wonder how that bypass works.
nicholassmith 14y ago
There's quite a good guide here: http://www.nsa.gov/ia/_files/os/applemac/I731-006R-2007.pdf http://www.nsa.gov/ia/_files/os/applemac/I731-006R-2007.pdf If its good enough for the NSA it's almost good enough for everyone else /tinfoilhatting
- runjake 14y ago
  It's not a good guide (anymore). It doesn't pertain to Lion or any recent version of OS X and is sorely outdated. Much of the security-related technologies, especially FileVault, have been either seen significant changes or been replaced. As far as I can tell, it was last updated during the 10.4 days. Aside from the general secure computing tips, it's a historical document.

by there 14y ago

wgx 14y ago

You can also disable target disk mode and add a firmware password to prevent a thief from booting the machine to any other disk, even removable media. http://support.apple.com/kb/HT1352 http://support.apple.com/kb/HT1352 edit: added Apple link.

nieve 14y ago
Note that the firmware password can be bypassed by any Apple tech who calls into their call center, identifies themselves, and requests it. It's defense against a casual thief, but not someone with Apple connections, LEA, or any of thousands of Apple employees and third-party repair places. Still worth doing, just not as secure as the ones on old IBM thinkpads, say.
- voltagex_ 14y ago
  I wonder how that bypass works.

nicholassmith 14y ago

There's quite a good guide here: http://www.nsa.gov/ia/_files/os/applemac/I731-006R-2007.pdf http://www.nsa.gov/ia/_files/os/applemac/I731-006R-2007.pdf If its good enough for the NSA it's almost good enough for everyone else /tinfoilhatting

runjake 14y ago
It's not a good guide (anymore). It doesn't pertain to Lion or any recent version of OS X and is sorely outdated. Much of the security-related technologies, especially FileVault, have been either seen significant changes or been replaced. As far as I can tell, it was last updated during the 10.4 days. Aside from the general secure computing tips, it's a historical document.