What is going on with File Vault 2?

[Rod]

I have recently seen an number of new MBA's and MBP's where File Vault was On where the users claimed they had not initiated that option. Is this a default setting on new laptops with Yosemite installed? Because if so it's causing all sorts of problems for my clients.
Obviously one can just switch it off in System Prefs > Security & Privacy > File Vault. The only catch is it takes hours to de encrypt and there is the risk of failure.
I dont use it myself preferring encrypted .dmg folders for the few pieces of data I want kept secure.
File Vault on the other hand causes all sorts of problems when it comes to repair, backup and restoring HD's. I hate to say it but many people cant even remember their Admin Password much less a Recovery Key.

It seems to me that unless you are carrying secret military files around with you encryption is likely to cause you more problems than it is ever likely to solve.

 

[Dysfunction]

FileVault was off (which is the default) when I received my new MBA in Jan. It's on now, I wouldn't have a non-encrypted mobile device that was anything more than a netbook. To be frank, most people have enough personal information on their laptops that it's not even funny how vulnerable they are to a single theft.

By the way, it's not a trivial 'click' of the mouse to enable it. You're prompted to write down the recovery key, have the option to store it with apple (using your AppleID), etc.. then it takes some time to perform the actual encryption, the process makes all of this clear.

 

[chscag]

I have recently seen an number of new MBA's and MBP's where File Vault was On where the users claimed they had not initiated that option. Is this a default setting on new laptops with Yosemite installed? Because if so it's causing all sorts of problems for my clients.

File Vault 2 is not on by default and as stated above, not easy to initiate. Your clients are likely turning it on by mistake - in other words, user error or a new user fidgeting with their machine.

 

[Rod]

I could go on and on about this but here is some info in reply to my subject on https://discussions.apple.com/message/27715802?ac_cid=op123456#27715802

In particular this statement, "Yosemite Upgrade automatically checks the box to enable FileVault for mobile Macs."

 

[chscag]

Interesting. I wouldn't have thought (if that is in fact true) that Apple would implement FileVault 2 without the user's input. Shades of Microsoft if that's true.

 

[chas_m]

This is a flat-out lie.

 

[bobtomay]

None of the portable Macs I did in place upgrades to Yosemite (only 4 or 5) enabled Filevault including 2 here in the house - a MBA and a MBP.
It is true that it is using LVG.

 

[Slydude]

Interesting. I wouldn't have thought (if that is in fact true) that Apple would implement FileVault 2 without the user's input. Shades of Microsoft if that's true.

Is this supposed to be happening on a clean install or upgrade? I did an upgrade install and don't remember having to turn FileVault 2 off.

 

[chscag]

Is this supposed to be happening on a clean install or upgrade? I did an upgrade install and don't remember having to turn FileVault 2 off.

According to the link that Rod provided and the ongoing discussion, it appears that the answer was a brand new Mac portable computer (MacBook Pro, Air, etc) shipped with Yosemite and FileVault 2 on by default.

I personally find this hard to believe. And as I stated above, if it is true, it's like something that only Microsoft would do. I noticed that chas_m said in his reply that it's a lie. I wish he would have given some supporting information to back that statement up.

 

[Slydude]

Agreed. I was thinking the same thing. If it is true then it would be something of a departure for Apple. Usually anything like that, including firewall and automatic login, are off by default and must be turned on by the user.

I thought maybe the machine was a refurb but I don't remember it being that way even then.

 

[Dysfunction]

According to the link that Rod provided and the ongoing discussion, it appears that the answer was a brand new Mac portable computer (MacBook Pro, Air, etc) shipped with Yosemite and FileVault 2 on by default.

I personally find this hard to believe. And as I stated above, if it is true, it's like something that only Microsoft would do. I noticed that chas_m said in his reply that it's a lie. I wish he would have given some supporting information to back that statement up.

If so, something has changed since January. When I took delivery of the MBA I'm currently using. I had to enable FV2.

 

[Rod]

This has really piqued my curiosity now. I too upgraded two existing MBP's to Yosemite only months ago and no FV enabled.
chscag may have hit the nail on the head with the, "brand new Mac portable computer (MacBook Pro, Air, etc) shipped with Yosemite and FileVault 2 on by default."
The author of the thread sounded genuine and although lot's of people on various forums get things wrong ie I dont believe everything I read I may just reply to the thread and see if I can get more information.
At this point I am not willing to dissmiss this out of hand as it would certainly explain what I have observed with some of my clients.
I will get back to this thread with results/replies as soon as I find out more.

 

[chscag]

Thanks Rod. Please keep us posted with what you find out.

 

[Rod]

Ah ha!

Got it! Now I understand; "But what's new in OS X Yosemite, is that more users are likely to enable FileVault than ever before—as at installation you have to consciously opt-out of having your hard drive encrypted, rather than opt-in."
Taken from this site (all credit to them)Take that FBI! OS X Yosemite Encrypts Disks by Default, Better Protecting Privacy | The Mac Security Blog
So it would appear that my source is (sort of) correct. File Vault will be enabled unless you choose not to.
I can only say if I was given the option at my recent upgrades I must have pressed "no".
Can't say I remember that so it may be an inclusion of the most recent version 10.10.2 that behaves this way.
My guess is a lot of people would opt for this without thinking much about the possible complications. After all everybody wants security, right?
Setting it this way Apple seems to be saying, this is what we advise but the choice is up to you. I'd call that enticement.
As for devices bought already set up with Yosemite by a dealer for a purchaser my guess is they would advise enabling File Vault.
I love the heading "Take that FBI !!" Wow, emotive stuff for the paranoid among us.

 

[chscag]

I love the heading "Take that FBI !!" Wow, emotive stuff for the paranoid among us.

Thanks Rod. If encrypting one's hard drive would really keep the FBI out, there would be some value to it if you were into doing nasty things with your machine. I don't think anyone actually believes that FileVault 2 is able to keep the FBI out. Or, for that matter the NSA.

 

[TattooedMac]

I HATE FileVault.
Rod, I remember having to make sure I checked NO for that feature. Most new people don't understand FileVault, and this can cause massive issues as you have found out. Although FV 2 is a step up from the original, have a read of this thread, where ways back in '09' I had a BIG problem, not understanding what I was getting myself into.
My solution is in the last paragraph, but the crux of it all, is Apple really really need to inform people more about the implications of turning FV on. Basically, if your HD hasn't got the room to put the de-encyption into a swap file, the FV won't be able to decrypt the Disk, and will give you a massive headache.

EDIT : The sad part is, people think they NEED to have FV on, but IMHO, unless you have secret squirrel stuff on your Mac, then its not needed. With the way Yosemite is, and earlier OS's, if you have a Mac stolen, you can remotely wipe it. Have a good PassPhrase to get into it, don't have Auto Login for Safari, and have a 1Password type password manager, you are generally 99% safe.
Another solution I have found I can't live without, id Little Snitch, and nothing can get onto my Mac, without my say so, and if I'm not sure where something is coming from, I click "Don't Allow" and I sleep happy at night.

I dont envy you mate !!

 

[Dysfunction]

Really, what needs to happen is the drives just need to all be SED. Seriously. Oh, and this really is where things will head.

 

[TattooedMac]

Really, what needs to happen is the drives just need to all be SED. Seriously. Oh, and this really is where things will head.

SED ? Surface-Conduction Electron-Emitter Display ;P

 

[Slydude]

Thanks for running that down for us Rod. When this thread started I was sure I had never seen anything about FileVault during the update. Since I didn't do a clean install I figured it preserved my setting from the previous install. Based on what you're saying I must have opted out and not realized it.

 

[Dysfunction]

SED ? Surface-Conduction Electron-Emitter Display ;P

SED - Self Encrypting Drive