Hacker News Reader

Comment by Analemma_ | Hacker News Reader

I'm not very familiar with FileVault, but does it not provide a recovery key when you set it up? (for writing down and stashing in a safe place or backing up to the cloud)

Every other FDE scheme I've ever seen does, accompanied by big scary "WRITE THIS DOWN. IF YOU LOSE IT, AND THEN YOUR DISK GETS CORRUPTED, YOUR DATA IS GONE FOREVER" warnings, and with good reason: yeah, if the master key sector is corrupted and you don't have a backup, you're screwed.

View on HN

It does provide you with a recovery key, but that recovery key is useless if the file containing the volume master key is lost or corrupted (as happened here). In FileVault the recovery key is to protect you from losing your password, not from the system nuking the master key.

Ah, that's my misunderstanding then. I always thought the recovery key was the volume master key, for the purposes of guarding against accidents like this. Good to know that's not the case; I think I should go check up on my backup solution now.

You can generate a new recovery key anytime once the volume is decrypted/booted:

    sudo fdesetup validaterecovery  # check
    sudo fdesetup changerecovery -personal  # change

Obviously this doesn't reencrypt the disk, so you can guess how it works.

Usually, disk encryption is done by creating a master key, which is then encrypted again for every user, using the user's password in OSX's case, that is allowed to access the disk.

This way, the user never can retrieve the master key and access rights can be modified all while keeping the master key and thus avoid re-encryption on the drive if a new user is added/an old one removed/one changes his/her password.

Downside: if the master key goes boom, so do the data, with no chance of any recovery.

If losing the master key (or the passphrase that decrypts it, at least) does not result in the data being gone forever then the encryption isn't worth much, now is it?

Reply on news.ycombinator.com