Skip to main content
Question

Prevent FileVault Decryption via Yosemite's Pre-Boot Recovery Options?

E
Forum|alt.badge.img+10

As usual, the Der Flounder blog alerts me to new information that may have a significant impact on our environment:
Yosemite’s FileVault 2 pre-boot recovery options

I'm most concerned about the third option ("My keyboard isn't working"), since it allows any FileVault-enabled user to decrypt the drive by supplying their password (side note: how is one supposed to enter their password if their keyboard is not working???). Since the Security and Privacy System Preferences pane is locked, there previously was no way for non-admin users to do this (we also have firmware passwords enabled to prevent them from doing it via the Recovery HD).

Is anyone else concerned about this? If so does anyone have ideas on how to prevent users from being able to do this? The only thing I can think of is removing the Reset Password Wizard app/binary from the Recovery HD, but that seems rather extreme with potentially unwanted side effects.

Thanks!
Eric

    gskibum
    Forum|alt.badge.img+13
    • gskibum
    • Valued Contributor
    • June 10, 2015

    I had a user do the "My keyboard isn't working" thing last week. I wasn't a fly on the wall to see the chain of events, but his keyboard was in fact not working which is what started the whole fiasco. Otherwise this wouldn't have happened. He swapped keyboards to move the process along.

    Are you using Casper to deploy FileVault institutional recovery keys?

    My user had a recovery key set by using System Preferences/Security & Privacy.

    E
    Forum|alt.badge.img+10
    • etippett
    • Contributor
    • June 10, 2015

    @gskibum We're using Casper but with individual recovery keys. Why do you ask? If I understand the process correctly, it wouldn't matter what kind of key we're using, since all that is needed to decrypt is an enabled user's password.

    Reply


    Most helpful members this week

    Terms & ConditionsCookie settingsAccessibility statement

    Cookie policy

    We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

     
    Cookie settings