Change Filevault 2 Login Screen Options - Encrypted Disk

This isn't a bug. This is the way FileVault-2's EFI boot authentication UI is built. When your Mac first starts up, EFI-boot takes over to decide what to do. It either continues to bring up the system to the typical OSX login screen, which is managed by OSX's system preferences, or it starts a special EFI pre-boot where it displays the FV2 unlock screen with the icons of designated OSX accounts approved to unlock the disk. Once you log on, the EFI unlock sequence carries forth your credentials, performing a single signon. This is fine for some people but not for others, including me. I added a PolicyBanner that still comes up during the signon process but it come up too late. I have submitted a UI request (not as a bug) to be able to either edit the EFI boot screen (look at /usr/standalone/i386/EfiLoginUI directory, none are editable using normal applications) or ask that a feature is included, probably in the FV system preference pane, to add a custom banner. I didn't include the request to allow just the name and password fields but that's something I'd also like to see. One problem with this account display method has to do with people trying accounts that aren't authorized to unlock the specific computer. I haven't tried using an incorrect password more than 3 times yet to see what happens. I also haven't tried a FV2-encrypted Mac bound to Active Directory (or Open Directory for that matter) to see how it functions with network accounts. FV2 is nice in that it is full disk encryption (FDE) at the block level but that also brings about a whole lot of changes to users used to using the file-level encryption of FileVault-1.

Looks like the article has changed. Unless I'm over looking something, that part is no longer in the article.

scooper4711 wrote:

This is most decidedly a bug.

According to the KB article here: http://support.apple.com/kb/HT4790?viewlocale=en_US&locale=en_US

it says:

List of users at the Login Window?

Filevault 2 will show a blank text field for both username and password. For security purposes Filevault 2 will not show a list of users.

I think this needs to be fixed.

@Andrew, how do you get it work? have you tried the said System Preferences option?

I tried that but the preboot FileVault2 login screen still stays at "list of users"..

My memory could fail, though.

Thanks

Ivan.

I do have the same problem , I have activated filevault (after migrating to Lion)

and now I do have a list of users on my login screen (and yes my configuration is set to have name and password requested fr login NOT a list of user)

Seems to be a bug to me ...

Any help ?

Hi,

Sorry ivwang - I hadn't tried it when I posted; only knew how it should work...

I just tried it in Lion too and it's not working as it used to in SL - looks like a bug and I've seen some other threads on this saything the same thing. Hopefully it'll get fixed soon.

Andrew

I am having the same trouble...

I did try and delete the login plist but that has no effect. I have reported the bug to apple and I suggest you all do the same. The more people that are effected that quicker it will get attention.

I do understand now why when I do exit from my session I do have the login screen with name/password (as setup in the preferences). It was a bit confusing to meto have this name/password login screen (when exiting from my session) and not at boot time.

Hope we will have at some point the possibility to configure the EFI login window to have name/password to login

Please let us know

Thanks

Peter:

Thanks for the great explanation! I was getting so frustrated with this that I was just about to start digging around at the boot level to see what I could find. Again, thanks for saving me the time and effort!

Now that I understand the issue I will resubmit my report as a feature request as well. I figure the more voices the more likely we will get this fixed.

Anyway, as a security professional myself I don't particularly like "security threw obscurity" but as a level of it, I do feel it can help. Just like policy banners and good multi character type passwords, we add encryption so if our computers are stolen (especially laptops) we know (well believe) that the likelihood someone will get to our data is small. After all isn't that what we are trying to protect here?!?!

Hey everyone

Had the exact same issue and the culprit was the 'Enable Users' option under SystemPref/Security&Privacy/Filevault.

You will always get the 'Disk Password Protected' option only if you refrain from enabling users under filevault.

Personally, I prefer to always work in shell when configuring my MBA as Lion's GUI is still buggy as of 10.7.2 >> To encrypt, run

1. diskutil list

2. Identify your disk location under /dev/disk0 - in my case:

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *240.1 GB disk0

1: EFI 209.7 MB disk0s1

2: Apple_HFS SSD 239.7 GB disk0s2

3: Apple_Boot Boot OS X 134.2 MB disk0s3

3. then run

sudo diskutil cs convert disk0s2 -passphrase yoursecretpassphrase

4. reboot 😉

Cheers

W

This IS a bug. If the user sets Display Login Window as: NAME AND PASSWORD and NOT LIST OF USERS, that preference should be used whether file vault is turned on or off.

I need name and password and I chose name and password but the EFI preboot disregarded what I chose and decided to use List of Users instead of what was selected.

That is why this IS a bug. Please fix.

It has been written up in bug reporter and quite a few folks have asked for this.

Please please please fix this

interesting discussion, i have the same problem and also thought it must be

filevault 2's fault, maybe it is...buuut whhyyy....

in my case i still had the login screen with the name and password field after startup WITH filevault 2,

it changed to the same behavior (user swithing with name and password field / startup with user-list/ icons and pw-field after startup) since i downgraded the the user-account i did the setup with from a admin to a standard account!

now i can't change it in the sys.-pref. / users and groups / login options either (just like your discription) - even not as admin, but i don't know if this allready wasn't possible with the admin account i did the the system setup with (the now downgraded)

this makes it even more strange to me

any ideas?

Just found this and tried and it works!! 🙂

http://derflounder.wordpress.com/2012/09/22/fdesetup-authrestart-filevault-2s-on e-time-encryption-bypass-feature/

ETA.... Upon a complete shutdown and started up again, it's still showing me the accounts that are encrypted 😟

Scooper,

Please let us know if you find anything.

I was even thinking about running some type of script that runs in the backgroud if you reboot. It woudl run the auth restart and would return to the log in screen instead of pre boot.

This would not help for a power on from off of course.

Also I am trying to figure out if at the pre boot they set up any kind of a lockout feature. For example how many times can you type in a wrong password?

Hi all,

in this thread, there appears to be a common misunderstanding.

sjva wrote:

This IS a bug. If the user sets Display Login Window as: NAME AND PASSWORD and NOT LIST OF USERS, that preference should be used whether file vault is turned on or off.

as an example, this quote refers to the Login Window, and the settings in the System Preferences regarding the Login Window. The Login Window has a distinct meaning - it is the window that appears when one is logging into an OS X system without FileVault encryption. This is the login window to which we've all been accustomed for many iterations of the OS.

As Peter describes, when using FIleVault2, the user is at an EFI boot authentication screen. This is most definitely not the Login Window, and therefore not controlled by settings entered in the System Preferences regarding the Login Window.

Using terminology confusing these two independent authorization methods confuses this issue. There are some similar aspects of these two authorization methods, however, we should all recognize that they are different and independent methods.

I too agree with the thrust of most of the comments which appear in this thread. Simply stated, I want a similar level of configuration control for the EFI boot authentication screen as we have for the Login Window. In fact, this is a policy requirement at my institution...

So, I'll keep tuned to the progress made in this and similar minded threads.

cheers,

Roy

Sorry Roy but I desagree with your comments. I have the same problem and it is a serious one. The fact that encrypting my HD now shows the list of users of my MBP which includes my name and picture and worst yet, the name and picture of my daughters (which use this MBP) is an unacceptable security breach. Now this info is available to EVERYBODY that just turns on the MBP, so whoever steals my computer now has a picture of my daughters an their names (This is more than serious if you loose your computer in a kidnapping prone country).

If this bug (a nice word for this big issue) is related to EFI vs normal login screen is irrelevant. Whoever at apple implemented this did a very lousy job on QC. If the EFI boot authentication can get the list of users, surely can get the login preferences. I really don't mind how apple should solve this (all through EFI or all through OSX) but FV2 is a bad thing until this is solved.

My understanding is that until you shutdown or restart, the disk image is decrypted while you work. So loggin in and then out to get to the normal login screen leaves you with no accounts visible but no encrypted disk ...

thanks to all for your help on this and look forward to any news

CC

PS: In my Mac Pro I can't even encrypt now as I have a stripped RAID set ... I was lot better with previous FV