FileVault 2 and screen saver/sleep lock

Question

Level 1

6 points

FileVault 2 and screen saver/sleep lock

I have FileVault 2 activated on my MacBook Pro; everything seems to be working OK. Screen saver is also activated and locks the computer, prompting for a password. However, I cannot seem to change the preference "Require password 'immediately' after sleep or screen saver begins" setting in the General pane of the Security & Privacy panel of System Settings. If I try to, for example, set it to "Require password '5 minutes' after sleep or screen saver begins" it will immediately revert back to "Require password 'immediately' after sleep or screen saver begins" as soon as I close out of System Preferences.

Is this a FileVault 2 default setting that you cannot change? Or is this a bug that was never discovered? Anyone else noticing the same problem?

MacBook Pro, Mac OS X (10.7)

Posted on Sep 4, 2011 5:53 AM

Reply

Answer 1

Sep 4, 2011 10:29 AM in response to jvaughn76

I also have FileVault 2 activiated, and I've noticed this too. But in my experience the setting doesn't revert until after I re-open System Preferences. Until then, the system respects the new wait-time setting, for both sleep and screen saver, even after logging out or rebooting.

I find this confusing for a few reasons. As far as I can tell from https://support.apple.com/kb/HT4790, sleep is supposed to re-encrypt the drive, but locking the screen because of the screen saver isn't (or at least it isn't mentioned). So on the one hand, if FileVault 2 is activated, it makes sense that a password would be required immediately after sleep, because the disk should be encrypted. But there would be no FileVault-related reason to require a password immediately after a simple screen-locking. But to complicate this, in my experience sleep *doesn't actually re-encrypt the hard drive*. At least, after waking from sleep, I am able to directly log in to user accounts that I haven't given permission to unlock FileVault.

--Allen

Reply

Answer 2

Sep 19, 2011 11:39 AM in response to jvaughn76

I'm having exactly the same issue, and it's particularly annoying. Either disable the functionality around changing the timeout at all, or honour the setting properly. This is something that someone should be able to change themselves anyway - if it makes the system more insecure, then warn the user but still give them the chance to override it.

Reply