AddThis Social Bookmark Button

Listen Print Discuss
Mac OS X > Excerpts >

An Unencrypted Look at FileVault
Pages: 1, 2

Does FileVault Pose any Threat to my Data?

Right after the release of Mac OS X v10.3, a few users noticed that their preferences files were reverted to the default settings after having used the "reclaim space" function. This soon led to horror stories that were published over the Internet by well-intentioned users who, most of the time, never had a chance to use FileVault themselves. Therefore, I feel that I should focus for a moment on how safe FileVault is, or isn't.



I have personally used FileVault on 10.3.0 without experiencing the slightest issue. Of course, this only reflects my own experiences, but chances are that I am not alone!

The above preferences "oops" has been corrected in the 10.3.1 release. Simply make sure that you install (at least) this update before turning FileVault on, and everything should be fine.

When you use FileVault, you should keep in mind that your data needs to be processed on login and on logout for the image-mounting and -unmounting processes to take place normally. Also, the data you are working on is constantly being encrypted and decrypted.

Related Reading

Mac OS X Panther Pocket Guide
By Chuck Toporek

Therefore, FileVault makes your computer a lot more sensitive to force restarts and crashes. If Mac OS X is unable to gracefully finish the data processing it has to do and unmount the image, some of the data may be damaged -- or the image may not mount the next time you log in.

That's why FileVault has been primarily designed for laptop users. In the event of a power failure, the built-in battery automatically kicks in and takes care of powering the computer. Should the battery run low, the computer will enter a low-power mode to protect the data until it is plugged into an outlet.

Therefore, although nothing technically prevents iMac, eMac, or PowerMac users from using FileVault, they should purchase a reliable UPS (uninterruptible power supply) before turning FileVault on.

The Macintosh Products Guide should provide you with some useful information.

You should also be careful about the applications that you use. Avoid haxies or incompatible disk utilities that could cause filesystem damage -- they are more common that one would think.

Of course, you should also back up your data very frequently. I like CD-Rs and DVD-Rs for two reasons -- once they are burned, they are burned and stable-- you cannot really alter them to add or remove files. Also, they are small in size and can be locked in a safe easily. Needless to say, your backup will be in an unencrypted form -- unless you back up the vault itself and not the data it contains, something that I wouldn't really recommend. Therefore, the physical security of your backup is extremely important. The disc might not be secure, but the safe is!

Speaking of backing up your data, you should be aware that FileVault may confuse a few backup utilities by preventing them from accessing specific files when the vault is closed. Also, some applications could think that your home is constantly changing, therefore, baking it up endlessly. You may want to speak with your system administrator or the authors of the backup application to make sure that everything is going well.

The FileVault Q&A

Now that we have seen some of the most important aspects of FileVault, it is time to do a little Q&A to answer the questions I have most frequently seen on support forums.

I have lost my password. Could you unlock it for me?

Sorry but no! Indeed, there are no "backdoors" that would allow someone to access your data by force-opening the vault. Your only chance, if you have an administrator, is that he or she has set up a system-wide "master password" that will open it, along with your own, forgotten, password.

Does FileVault affect performance?

Mac OS X v. 10.3 is an extremely fast and powerful operating system and is more than able to encrypt and decrypt data on the fly -- provided that it is run on supported hardware, of course.

I've conducted tests on a 12" PowerBook G4 and did not notice the slightest performance decrease while typing articles (such as this one), using Keynote, surfing the Web, and sending emails.

Keep in mind that FileVault has been designed for business users who handle sensitive data. In this environment, it is therefore perfectly at home and does not impact the user's workflow in any way.

However, users of audio or video applications such as iMovie or FinalCut Pro may want to either not use FileVault or set up these applications to work outside of the protected area.

Indeed, such software usually handles very large files and performs processor-intensive tasks, the intensity of which is increased by the encryption process.

But don't worry, changing the settings of most of these applications is very easy to do! Here is the information that you will need for iMovie and the FinalCut family.

Some users have also suggested that you put your iTunes library outside of the vault if it is very important.

Once again, this is not a design flaw. FileVault has been designed to secure sensitive information. To secure it, it must use military-strength encryption. And nowadays, on any platform, with any OS, such encryption is resource-intensive.

Can I use FileVault to encrypt specific files or folders that are located outside of my Home folder, or to encrypt only parts of my Home folder?

No. FileVault encrypts your whole Home folder, and I definitely don't recommend that you try to tamper with it. However, rest assured that Apple didn't forget you. The good old encrypted disk images are still here and can provide you with the same level of security as FileVault.

Actually, I the idea of encrypting the whole Home folder since it makes the "interesting" data even harder to find for the hacker. Plus, the encrypted file is much bigger and requires the hacker to run very powerful computers if he even considers conducting a brute-force attack.

Can I/should I use FileVault in conjunction with the "Secure empty trash" feature?

FileVault does not interfere with the "Secure empty trash" feature, and you should be able to use it normally. Using it will provide you with an extra layer of protection by making sure that the data does not remain on the disk after its deletion.

If you use FileVault, it makes sense to always use the "Secure empty trash" feature for any file located outside of the vault. Secure-emptying the trash takes a bit more time, but it is the only way to make sure that a file has physically disappeared from the hard drive.

Do I need a special Mac model to use FileVault?

We saw above that FileVault has been primarily designed for laptop users but, with a few additional precautions, desktop users can unleash its power, too.

Of course, the faster your Mac is, the less you will notice that FileVault is turned on. I performed some "real world" tests on an old G3 iBook (one of the first white ones) with 128Mb of RAM and did not notice any intense slowdown. Therefore, it is safe to say that FileVault can be used on any computer officially supported by Mac OS X.

Who should turn on FileVault?

FileVault is a military-strength security feature that has been designed for businesses and special users in mind. Although it is remarkably sleek, easy to use, and transparent, turning on this feature implies that you slightly change the way you use your computer. Of course, should you handle sensitive data, chances are that these precautions are already part of your daily routine. For such users, FileVault is (dare we say it), the perfect feature, combining safety, effectiveness, and ease of use.

However, although most home users will be able to turn it on and use it, they should keep in mind that they may not need it.

Don't get me wrong: I think that computer security is of the utmost importance and would certainly not tell Mac users not to protect themselves. However, the vast majority of home users should focus on consolidating their other security systems -- anti-virus, firewall, and passwords.

One could argue that it would have been possible to create a less restrictive encryption scheme that would have been easier to use, but I would have to respectfully disagree. Indeed, in order to be fully effective, cryptography has to be strong and fully encrypt data.

Casual users may rely on the Keychain to store encrypted notes; this small application has hidden wonders that are luckily well explained in the Mac Help an in the AppleCare Knowledge Base.

How Should I Turn FileVault on?

Turning on FileVault can be as easy as using the Security preferences pane, available through the System Preferences application. However, to fully unleash its power and to avoid any issues, I recommend that you follow these steps:

  • Disconnect your computer from any network and clean-install Panther by following these steps. However, instead of using the Disk Utility to simply initialize the drive, you should take advantage of its "Zero all data" and "8 Way Random Write Format"" options in order to make sure that no data can physically remain on the drive. Be aware, though, that this step can take a very long time and will put your drive's mechanism to hard work.
  • Immediately turn on Mac OS X's built-in firewall, or install the security applications required by your network administrator.
  • Update your installation to the latest Mac OS X release available. The Software Update preferences pane should handle the job beautifully.
  • Then turn FileVault on, while your Home folder is still empty, and disable automatic login. All of this can be done through the Security and Accounts preferences panes.
  • Then, install your applications.
  • Finally, copy your data directly into the FileVault from the backup you performed before the installation.
  • Do not forget to check your backup application and to back up your data frequently.

Conclusion

FileVault is an extremely powerful, yet sleek and easy to use, feature that will make the lives of all users who handle sensitive data a lot easier. The underlying technologies it uses and Apple's attention to detail make it a stable and secure system. FileVault is a great feature, since so many companies now use Mac OS X.

However, like any such feature, it has not been designed to play with and requires that you pay attention to what you do. Therefore, while it is perfect for the business user or the frequent traveler, it is not something you want to use on your kid's gaming account or on grandma's tangerine iBook to protect her healthy cooking tips database -- unless she also beta tests Mac OS X v.11 for Apple. But that's another story.

FJ de Kermadec is an author, stylist and entrepreneur in Paris, France.

Return to the Mac DevCenter