FileVault 2 Issues and downside?

You can't start up in Safe Mode if FV2 is enabled.

Also, if you have other users on your mac, they won't be able to actually start or restart the mac unless you enable them with an FV2 password. However, if you enable them then the entire disk (including your own home folder) is unencrypted. That gives them read access to your and any other users files through single user mode.

Personally, I'd stay away from FV2, but there'll be others along soon who will quickly come to its defense. As you seem to have figured out already, you'll need to weigh the pros and cons according to your own needs.

Just so you know, the performance hit is negligible. If you have a 2011 or later Mac, the Intel chips have crypto acceleration built in. The "penalty" is on the order of 1% or less.

I've been using FileVault 2 on all my portables since it shipped. I've had no issues.

Applying FileVault 2 on a computer running an SSD (solid-state drive) will apparently mark every cell on the SSD as "in-use", causing major problems for built-in algorithms designed to apply wear-levelling to the drive and thereby affecting longevity. This can be avoided by applying the FDE in a different manner. See this post (and the one it refers to) for more details.

Regarding the link to a different post, I'm a computer scientist and I'm going to have to read that a few times to be sure I understand all of it

It's easy: simply format the drive as HFS (Encrypted) before you start, as opposed to populating the drive first and then turning on FileVault 2. When you boot from it it'll then ask you for a password before it even mounts the drive, and on successful entry take you straight to the login screen (and not into a user's account like FileVault 2 does).

🙂

EDIT: For additional security, you can even use the original FileVault encryption on top of FileVault 2, so that the entire drive is encrypted and therefore requires a password to mount, and then each user's individual home folder is encrypted an additional time. This is an Apple-supported measure.

You cannot enable FileVault (1) on a machine running FileVault 2. You would need to migrate an old FileVault-encrypted home directory.

This is a total waste of effort on a non-shared system, FWIW. I would never recommend this.

If you have FileVault 2 enabled on a multi-user system where everyone has the FileVault password, and you have secure data you wish to hide from others, I'd say encrypted disk images for specific content make more sense than encrypting the whole home directory.

I'd consider "Filevault 1 on top of FileVault 2" to be deprecated at best.

I would be absolutely SHOCKED if this applies to an Apple system that ships with a built-in SSD.

Just FWIW, all my Mac portables have SSDs in them (shipped that way from Apple). I've been using them for 2 1/2 years and have experienced no slowdowns or issues of any kind.

With 3rd party SSDs, I can't say.

You cannot enable FileVault (1) on a machine running FileVault 2. You would need to migrate an old FileVault-encrypted home directory.

Apple specifically refer to using FV 1 over FV 2 in their Apple Technical White Paper: Best Practices for Deploying FileVault 2:

Support for multiple OS authenticated users means that any FileVault- enabled user can unlock the whole volume, as would be expected. However, if the system environment warrants additional cryptographic separation and containment of user files, consider using Legacy FileVault (FileVault 1) simultaneously. Coverage of Legacy FileVault on an OS X system using FileVault FDE is out of scope of this paper. In brief, it’s the

continued use of FileVault 1, container-based encryption of the user’s home directory, on top of FileVault 2 providing full disk encryption.

(p28)

Is there a patch/plugin to enable older versions of OS X to mount and read encrypted disks?

This functionality is a core part of Mountain Lion. Apple won't be retroactively enabling it in Lion, I'm afraid.

The key phrase here is "continued use of FileVault 1."

It's not possible to enable the old container-based FileVault on a new machine. FileVault 2 is the only option. The only way you could do the "stacked" approach is on a system that was originally set up with multiple FileVault encrypted home directories and later moved to FileVault 2.

Depends more on year and common HPC offerings than on vendor. A "tightly coupled" architecture (ie., where the kernel et al is heavily modified to tie into the interconnect hardware and topology, to the extent that the kernel can't function without the interconnect) is a wildcard as such a thing would definitely not be a COTS product and could reasonably be expected to be architected per customer, if not per purchace. Given "loosely compled" (where, say, a compute node can boot and run independent of the interconnect with most or all of it's local functionality intact), and the new mac's cpu/ddr specs, that's more reasonable; I'd say you could get into the ~150TFps range (ie., current to ~2010) with around 30k cores (not nodes, or dies ie., a Nehalem would count as 16 cores). My last big system was an Altix ICE 8200 at 36k cores, and it could sustain ~162.1TF, but that was with slower cpus and memory, and only one plane of 2x Infiniband. The 2013 "norm" is more like 75k cores and later generation IB and DDR, so maybe triple the TFps target.