Anyone using FileVault??

Macinbowl · Post by **Macinbowl** » Wed Oct 04, 2006 12:24 pm

I don't know if I should set it active or not on my powerbook. It would be safer when I'm on tour, and that's often, but what I don't know if I REALLY need it. Am I "visit" that often? Is there a way to find out? Can it make my system slower when working on my audio apps?

Anyone have an opinion or an experience on the subjet?

Thanks!

Mat

jarok · Post by **jarok** » Thu Oct 05, 2006 2:36 am

Hi

I don‘t have FileVault activated on my powerbook.

I found this from Mac Help:

Quote:

About FileVault

Mac OS X includes FileVault, which allows you to encrypt the information in your home folder. Encryption scrambles the data in your home folder so that your information is secure if your computer is lost or stolen.

FileVault uses the latest government-approved encryption standard, the Advanced Encryption Standard with 128-bit keys (AES-128).

When you turn on FileVault, you also set up a master password for the computer that you or an administrator can use if you forget your regular login password.

WARNING: If you turn on FileVault and then forget both your login password and your master password, you will not be able to log in to your account and your data will be lost forever.

If the information on your computer is of a sensitive nature, you should consider using FileVault. For example, if you carry all your company's financial data on your PowerBook, losing your PowerBook could allow someone else access to sensitive data that might hurt your business. If you are logged out of your account when your PowerBook is lost, and FileVault is turned on, your information is safe.

If you're thinking about using FileVault, you should be aware that it could affect scheduled backups and interfere with access to shared folders in your home folder. Since FileVault creates an encrypted home folder, some backup utilities may see your home folder as one folder that's always changing, and this could slow down your backup. Also, if you're not logged in to your computer, other users will not have access to shared folders in your home folder.

For information about using FileVault, click "Tell me more."

jarok

Macinbowl · Post by **Macinbowl** » Thu Oct 05, 2006 4:28 am

Thanks Jarok!

It may be a good thing for me. I have to find a way to of being able to use "Backup" though. I'll make some research.

Anybody using FileVault AND Backup?

Mat

sdemott · Post by **sdemott** » Thu Oct 05, 2006 6:47 am

I wouldn't enable FileVault on any account you run your DAW from because there is CPU overhead associated with FileVault.

Instead of FileVault, you can also just create encrypted disk images to store sensitive data.

Otherwise, as long as you have a separate account to run your DAW from (which you should be doing anyway) you can enable FileVault on any other accounts on the system.

Just my $0.02

jarok · Post by **jarok** » Thu Oct 05, 2006 7:11 am

Now that I think about it.

In Login Options you can also disable automatic user/ admin. login, if you don‘t want it on startup.

If you log yourself out before Shut Down-

Every time you start your powerbook up, you‘ll have to log your self in as an user/ admin. And that way FileVault would not be necessary at all.

jarok

baanes · Post by **baanes** » Thu Oct 05, 2006 1:51 pm

Even after doing what jarok suggests, if someone stole your computer then they would be able to pull your hard drive and access your files. Filevault would prevent them from doing this unless they figured out your password. Unless you have sensitive data which you really need to take on tour it probably isn't worthwhile. I'm a little unclear as to what you are looking for... not sure what you mean by "am I visit often." While you're logged on, filevault won't help you at all.

sdemott · Post by **sdemott** » Thu Oct 05, 2006 1:58 pm

jarok wrote:Now that I think about it.

In Login Options you can also disable automatic user/ admin. login, if you don‘t want it on startup.

If you log yourself out before Shut Down-

Every time you start your powerbook up, you‘ll have to log your self in as an user/ admin. And that way FileVault would not be necessary at all.

jarok

This only deters the casual hacker. There are several ways ot get around this, including:
* booting from an OS install disk
* booting from another startup drive (FW or otherwise)
* booting into single-user mode and mounting the filesystem from there (as SuperUser)

FileVault simply creates an encrypted sparse disk image (.sparseimage) of your home directory that only un-encrypts upon successful authentication. You cannot bypass it by booting from another startup drive or in single user mode. Thsi is why I suggest the encrypted disk image for sensitive data as an alternative.

Even setting an Open Firmware password can be bypassed easily. FileVault is secure, but it requires the DiskImageMounter to load in the background and remain resident in memory throughout the time you are logged in. So, again, very useful for any account except the one you run your DAW from.

Macinbowl · Post by **Macinbowl** » Thu Oct 05, 2006 3:48 pm

So, correct me if I'm wrong but here's how I understand I can have a safe and effective PB:

-> 2 Partition - One with OSX installed, that I will use for work and personal stuff with FileVault enable, and one again with OSX installed on it but with only my audio apps and FileVault disable.

-> Both system would be set at single user mode. I'm not quite sure if I know and understand well how to my sensitive data on a encrypted disk image but I guess I create a disk image of a certain folder and put important data in it... Is that correct?

Do I forget something?

Thanks for all that VERY useful info guys!

Mat

sdemott · Post by **sdemott** » Thu Oct 05, 2006 4:28 pm

No need for separate partitions- simply setup OSX with 2 user accounts:

* user account #1 is only for your DAW/Audio apps. never launch anything else since oft times apps install background daemons that sap CPU cycles (like MS Office, iCal, iTunes, Palm, et al)

* user account #2: for everything else, with file vault enabled.

It is stilll possible to boot the PB if stolen, but no one will have access to any data in user account #2 (which should be alll your data, unless you keep audio files in user account #1).

Hope that makes sense.

Macinbowl · Post by **Macinbowl** » Thu Oct 05, 2006 9:53 pm

sdemott wrote:Hope that makes sense.

It is! Thanks!

I will do that. The problem with that kind of change is time... where the h... am gonna find time for that!!!

I guess a couple days off couldn't hurt!

Mat

jarok · Post by **jarok** » Fri Oct 06, 2006 3:19 am

Hey Macinbowl

It‘s nice that somebody finally brakes this mystery up for you.

jarok

Macinbowl · Post by **Macinbowl** » Mon Oct 09, 2006 12:56 pm

jarok wrote:Hey Macinbowl

It‘s nice that somebody finally brakes this mystery up for you.

jarok