"pmset -g destroyfvkeyonstandby" not working?

Question

Level 3

825 points

"pmset -g destroyfvkeyonstandby" not working?

Hi,

So I read about this setting recently and implemented it on my MacBook Pro:

destroyfvkeyonstandby - Destroy File Vault Key when going to standby

mode. By default File vault keys are retained even when system goes to

standby. If the keys are destroyed, user will be prompted to enter the

password while coming out of standby mode.(value: 1 - Destroy, 0 -

Retain)

Running pmset -g reveals this is now correctly set to "1". However, when waking on sleep I'm only prompted for my user login password, not the FV2 password. I rebooted the machine but this didn't change anything. My only conclusion is that I'm misunderstanding the meaning of, "standby mode". Can anyone shed any light on this?

MacBook Pro (15-inch Early 2011), OS X Mountain Lion (10.8.2), 120GB SSD, 4GB RAM

Posted on Sep 30, 2013 1:16 PM

Reply

Answer 1

Scotch_Brawth Author

Level 3

825 points

Oct 9, 2013 5:52 AM in response to Scotch_Brawth

No-one using this security feature? No-one knows what Apple's man page means exactly by, "standby mode"?

😟

Reply

Answer 2

13th

Level 1

10 points

Oct 9, 2013 10:39 AM in response to Scotch_Brawth

To make full use of this feature you would also need to instruct your MacBook Pro to hibernate (standby) and remove power from the RAM. Hibernate mode 25 instead of hibernate mode 3 would be the appropriate configuration. It will be a longer wake and sleep but more secure.

The full command to set this up would be:

sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25

hibernatemode = 3 (binary 0011) by default on supported portables. The system will store a copy of memory to persistent storage (the disk), and will power memory during sleep. The system will wake from memory, unless a power loss forces it to restore from disk image.

hibernatemode = 25 (binary 0001 1001) is only settable via pmset. The system will store a copy of memory to persistent storage (the disk), and will remove power to memory. The system will restore from disk image. If you want "hibernation" - slower sleeps, slower wakes, and better battery life, you should use this setting.

destroyfvkeyonstandby - Destroy File Vault Key when going to standby mode. By default File vault keys are retained even when system goes to standby. If the keys are destroyed, user will be prompted to enter the password while coming out of standby mode.(value: 1 - Destroy, 0 - Retain)

Reply

Answer 3

Scotch_Brawth Author

Level 3

825 points

Oct 10, 2013 2:29 AM in response to 13th

Thanks 13th. I was afraid of that. I use an SSD so won't be turning on hibernate.

Reply