Cubic Earth (OP)
Legendary
Offline
Activity: 1176
Merit: 1020
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 28, 2013, 08:22:11 AM |
|
I know this is a little bit off topic -
Does anyone know how make os x display the recovery key (really just the direct encryption key) for an encrypted drive? I've been going though a process of doubling down on all of my security procedures. One result is going to be a bunch of encrypted drives, and I will be greater risk of data loss if all else stays the same.
First I would like to make os x show me in - plain text - each of the keys. Then would like to have a way to test out each of those keys and prove to myself they are capable of decrypting the drive.
Does anyone know some terminal commands that would work? Google is not being my friend.
Thanks
|
|
|
|
empoweoqwj
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 28, 2013, 08:37:24 AM |
|
I know this is a little bit off topic -
Does anyone know how make os x display the recovery key (really just the direct encryption key) for an encrypted drive? I've been going though a process of doubling down on all of my security procedures. One result is going to be a bunch of encrypted drives, and I will be greater risk of data loss if all else stays the same.
First I would like to make os x show me in - plain text - each of the keys. Then would like to have a way to test out each of those keys and prove to myself they are capable of decrypting the drive.
Does anyone know some terminal commands that would work? Google is not being my friend.
Thanks
Wouldn't be very secure if it just showed the keys in plain text would it ....
|
|
|
|
Cubic Earth (OP)
Legendary
Offline
Activity: 1176
Merit: 1020
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 28, 2013, 08:53:24 AM |
|
It's a fundamental security weakness that us humans can only read plain text. I would only be revealing it to myself in a secure environment. Anyway, I've found some of what I was looking for.
Here is the option, as part of the "fdesetup" command.
-outputplist Outputs the recovery key and additional system information to stdout in a plist dictionary. If the recovery key changes, a Change key will be set and the EnableDate will contain the date of the change. This should not be used when using the deferred mode.
Now my next question: where would that plist directory reside?
|
|
|
|
empoweoqwj
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 28, 2013, 08:57:18 AM |
|
It's a fundamental security weakness that us humans can only read plain text. I would only be revealing it to myself in a secure environment. Anyway, I've found some of what I was looking for.
Here is the option, as part of the "fdesetup" command.
-outputplist Outputs the recovery key and additional system information to stdout in a plist dictionary. If the recovery key changes, a Change key will be set and the EnableDate will contain the date of the change. This should not be used when using the deferred mode.
Now my next question: where would that plist directory reside?
I really meant if you can see the keys, what's to stop someone stealing your Mac and grabbing them all?
|
|
|
|
Trizin
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 70
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 28, 2013, 09:34:58 AM |
|
|
|
|
|
stimpi
Newbie
Offline
Activity: 7
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 28, 2013, 09:42:51 AM |
|
It may be easier to disable filevault and then re-enable it. Once re-encrpyted, the master (backup) recovery key pops up in an alert box, which you can take a note of.
|
|
|
|
empoweoqwj
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 28, 2013, 10:27:25 AM |
|
I wish people would just post a quick answer, rather than a link which may or may not be useful.
|
|
|
|
bitpop
Legendary
Offline
Activity: 2912
Merit: 1060
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 28, 2013, 03:08:49 PM |
|
Glad my bitlocker does just that. You guys don't get a recovery key??
|
|
|
|
michagogo
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 80
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 28, 2013, 09:11:40 PM |
|
I really meant if you can see the keys, what's to stop someone stealing your Mac and grabbing them all?
If someone steals your Mac and it's powered on and unlocked, then you've already lost all your data. If it's not, then those keys won't be accessible without first booting up, which requires the passphrase to decrypt the key.
|
|
|
|
Cubic Earth (OP)
Legendary
Offline
Activity: 1176
Merit: 1020
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 29, 2013, 02:29:07 AM |
|
+1 to the above. Glad my bitlocker does just that. You guys don't get a recovery key??
When you encrypt the boot drive with filevault, you are provided with a recovery key. I wrote mine down. As far as other encrypted volumes go, including time machine backups, you are not provided with a recovery key as far as I can tell. I really meant if you can see the keys, what's to stop someone stealing your Mac and grabbing them all?
You need to enter you credentials before the key(s) was displayed.
|
|
|
|
empoweoqwj
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 29, 2013, 04:29:43 AM |
|
+1 to the above. Glad my bitlocker does just that. You guys don't get a recovery key??
When you encrypt the boot drive with filevault, you are provided with a recovery key. I wrote mine down. As far as other encrypted volumes go, including time machine backups, you are not provided with a recovery key as far as I can tell. I really meant if you can see the keys, what's to stop someone stealing your Mac and grabbing them all?
You need to enter you credentials before the key(s) was displayed. OK thanks. I've not used filevault yet. Might give it a spin. Does it slow the system down much? My MacBook is ageing (2010 model), saving up for a Darth Vadar model in 2014.
|
|
|
|
bitpop
Legendary
Offline
Activity: 2912
Merit: 1060
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 29, 2013, 05:12:21 AM |
|
Oh you guys use a password not the tpm
|
|
|
|
Cubic Earth (OP)
Legendary
Offline
Activity: 1176
Merit: 1020
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 29, 2013, 05:32:46 AM |
|
OK thanks. I've not used filevault yet. Might give it a spin. Does it slow the system down much? My MacBook is ageing (2010 model), saving up for a Darth Vadar model in 2014.
If you get a new Mac that comes with a SSD, the decryption is hardware accelerated. I have filevault enabled on my haswell macbook air and the disk I/O is lightning fast.
|
|
|
|
empoweoqwj
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 29, 2013, 05:36:05 AM |
|
OK thanks. I've not used filevault yet. Might give it a spin. Does it slow the system down much? My MacBook is ageing (2010 model), saving up for a Darth Vadar model in 2014.
If you get a new Mac that comes with a SSD, the decryption is hardware accelerated. I have filevault enabled on my haswell macbook air and the disk I/O is lightning fast. Yeah sounds like an SSD is a must. Thanks. Not sure my "give it a spin" is appropriate in that case though ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
|
|
|
|