search

drduh / macOS-Security-and-Privacy-Guide

Guide to securing and improving privacy on macOS
https://drduh.github.io/macOS-Security-and-Privacy-Guide/
MIT License
21.24k stars 1.45k forks source link

Which way is more secure? #230

Closed sickamongthepure closed 7 years ago

sickamongthepure commented 7 years ago

I'm wondering which way of deploying FileVault is more secure:

  1. Turning on FileVault in System Preferences after installing macOS.

  2. Before installing macOS make encrypted partition in Disk Utility and then install macOS.

What do you think?

1dotd4 commented 7 years ago

It should encrypt automatically the partition before to install. Or it isn't?

ghost commented 7 years ago

I think he is asking about encrypting the drive from the recovery/bootable Installer (i.e. Disk Utility -> Erase > Mac OS (Journaled, Encrypted) versus erasing it regularly and then encrypting it during system setup (or some point later).

I actually had the same question and was wondering if anyone knew the advantages/disadvantages of both.

felixgr commented 7 years ago

I looked at the seeding of Apple's PRNG a few years ago. Things might have changed since then. Back then, the PRNG had more entropy available in scenario 1 because of the recent reboot. So, just based on that knowledge, scenario 1 seems more secure.

walkky commented 2 years ago

Is this still the case with Apple Silicon / M1-based MacBooks?

Danrancan commented 2 years ago

I looked at the seeding of Apple's PRNG a few years ago. Things might have changed since then. Back then, the PRNG had more entropy available in scenario 1 because of the recent reboot. So, just based on that knowledge, scenario 1 seems more secure.

I actually remember reading a blog post about this just over a year ago as well. The blogger agrees with you in that scenario 1 is the best way to go about it. However, if you create the encrypted disk before installation, doesn't that allow you to create two seperate passwords? One being specifically to unlock the encrypted drive and the other being to log in to mac os after unlocking it? If thats the case, I would say that scenario 2 supersedes scenario 1 even if it has less entropy, because it allows for multiple seperate passwords. Although, I could be wrong on all of this. Its been a while since I've done a clean install of MacOS.