4 ms·

There is an issue with user switching and firewire/DMA that allows remote access as well as cold boot attacks but these are out of reach of most people.

• acdha 13y ago
  firewire / thunderbolt DMA access was fixed many years ago: if you enabled a firmware password, those buses have DMA disabled.
  • toomuchtodo 13y ago
    Are you saying that if I have a firmware password on my MBA that my internal SSD is inaccessible via Thunderbolt externally (until I've entered my password)?
    • aroch 13y ago
      No, but your TB device wouldn't have read access to physical memory (where keys would be)
    • acdha 13y ago
      No - but it means that a device can't read your FileVault keys out of memory so all they can read is the encrypted volume.