Hacker News Reader

Comment by dsego | Hacker News Reader

The thing that scared me recently was two updates that gave me new encryption keys. At first I trusted apple and wrote down the new key. But I became suspicious after the second update and checked online. It seems like it's happening to others, so I used the recommended command-line tool to verify my new encryption key and it didn't verify. Apparently it works after disabling and enabling encryption, but I'm just keeping it disabled for now.

View on HN

This also spooked me. I’m a former security professional—there are few good reasons Apple should be doing this, and it smells of a targeted attack. If I had a zero-day exploit to steal your data, this is what it would look like.

In the other hand, if Apple suddenly found out that a good chunk of encrypted volumes weren’t actually encrypted / the key was recoverable by an offline attacker, this would also explain the facts.

But the lack of explanation from Apple is troubling.

Yeah, I’m one of the people affected by this and it has happened to me on multiple machines on multiple updates and I have no idea what’s happening. Of course the keys do not actually work like for everyone else, which is even worse from a consumer UX standpoint (if I didn’t knew better I’d just throw away the old key…)

It's on my todo list to backup and wipe that machine at some point. It's a desktop machine, not a laptop, and I don't save the recovery key to my iCloud, so I don't see how this could be a security threat. But something smells fishy.

Sorry, can you give a few more details? Are you talking about FileVault encryption on your Mac? Or the newish iMessage encryption?

And what command line tool are you referencing?

Oh sorry, I would edit the comment but it's locked, I realize now it's not that clear. This is about FileVault encryption on Mac and the recovery key. I think the command was `fdesetup validaterecovery`.

This is less severe than losing an account because at least the encrypted drive is backed up, right? :)

> updates that gave me new encryption keys

On iOS or macOS? Was a consent dialog presented before the update was installed?

Sorry, macOS, I don't remember about the consent.

I'm not him, but for me it was MacOS. After the update was installed and the system rebooted it presented a dialog asking if I wanted to be able to use iCloud for recovery if I forgot my Mac login password. I let it set that up.

Afterwards I wondered if it was just storing the recovery key I already had in iCloud or if it had generated a new recovery key and my saved one was invalid.

I checked my recovery key ("sudo fdesetup validaterecovery") and it was no longer valid. A bit of Googling failed to turn up a way to get a copy of the recovery key that was in iCloud, and I decided I'd rather have a recovery key I store myself in case I need to recover when I cannot get online so I switched it back.

Switching back is easy. You just turn off FileVault, then turn it back on and choose to manage the new recovery key yourself.

Dumb question but how did you find this out? Do you manually check after every software update?

On the first update when it showed me the message, I trusted it and wrote down the new key and threw the original piece of paper into the trash. Then the second time it showed up, I became suspicious and did a quick google search and then ran the command tool just to confirm that the new backup key validates, but it didn't. My hunch is that it was still using the original key I had set up myself, but I couldn't confirm since I had tossed it.

Can you share the command

I think it was fdesetup validaterecovery.

Oh wow, thanks for the heads up! Turns out my recovery key was also invalid... That's something Apple really should have notified people about. These kinds of slip ups without notifying users is terrible.

maybe apple is tired of copying Samsung and will copy google for once :)

https://news.ycombinator.com/item?id=38043574

That was the moment I started browsing „freebsd desktop“ forum posts…

You should try Qubes OS instead.

Reply on news.ycombinator.com