Encryption is super important because it secures your data in case your machine is stolen. There is an active market for identity data from stolen hard disks; don’t be that victim. It sucks.
If your machine is stolen and off*
I always turn my computer(s) and phone off before entering airports and other similar areas. They can ask me before Cellebriting them.
Not that I've ever done anything wrong, it's just for the ethics of it all. Privacy is critically important.
This is obviously a rare case but it just goes to show that you can have pretty darn good security and there are still attack vectors that you won't be hardened against.
This would also immediately lock the computer in the case of someone snatching it from you, even though the main use case I had in mind is just for falling asleep and for leaving the room.
Dunno if it’d drain too much battery. Also having the camera active indicator led glow all the time would be annoying. And it would also mean that you unfortunately no longer know if other software on your computer is recording your face while you are sitting there.
I mostly used that at CCC events where I was paranoid about forgetting to lock my laptop when I left it unattended, but it would also defend against that scenario pretty well.
EDIT: Confirmed. This works. In a few minutes, I was able to set it up so that if my watch moves about a meter away from the mac, it'll lock the screen. It supports any Bluetooth LE device.
(no relation, just a happy customer)
Still, it made me pretty uncomfortable using devices in public after that. For all the effort we put into cybersecurity, our measures are trivially defeated by a common thug. Even YubiKeys securing all your accounts wouldn’t do much to protect you from this.
[1] https://github.com/ts1/BLEUnlock
[2] https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-k...
When you see that people need to write this disclaimer even on this website it feels like the privacy ship has long sailed.
> If your machine is stolen and off*
It's possible to configure macOS to wipe FileVault keys from memory when transitioning to a hibernation state. Assuming this works as designed, it might help in a snatch-and-grab situation if the thief closed the lid of the laptop. I would assume competent LEAs would take measures to keep their target's machine awake however.
Locked. macOS has used the IOMMU to block access to RAM from external devices for many years and on the newer Macs you’d need to compromise the T2 as well.
https://www.zdnet.com/article/hackers-claim-they-can-now-jai...
That brings me to the second part of why this fear mongering is pointless: if the black-bag types are interested in you, they’re going to use the password they recorded you entering when you last turned it on or just hold you until you unlock it. If your threat model includes state-level force, you’re way outside of what consumer electronics can help you with.
For most people, the risk is more along the lines of whether someone who steals your backpack can cash out relatively quickly. Needing a complex exploit chain is not a high risk there - and, again, if you’re carrying something that valuable I’d be thinking more about the odds of them forcing you to unlock it.
Finally, the article you linked is talking about a jail break exploit: notably neither checkm8 or checkra1n will help you if you don’t already know the device password.
https://github.com/SAP/macOS-enterprise-privileges
Essentially you can still be the admin on your account but this app can make you a general user. When you need to install anything, run the app and grant yourself temporary admin rights. If you deploy this to employees with a management system, you can define default reversion to general user. It addresses the need to not allow users to be admins all the time, grants only when the need it for installation.