FileVault Encryption Password - Yosemite

Question

Level 1

17 points

FileVault Encryption Password - Yosemite

I enabled the FileVault encryption when upgrading my Mac to Yosemite. I was not given a passcode. Yosemite allows use of your login password as the method to access the encrypted drive.

However, I saw a posting on another site that has me confused. the poster on that site indicated that the encrypted drive's password is the password that was in place AT THE TIME of encryption. And that it is permanent and does not change if one changes the AppleID/iCloud password.

Is that the case?

If so, this could prove very problematic. I know my passwords, and very likely would be able to recall what I used when I did the encryption. But I also support several family members that certainly would not remember their password months or even years back. Nor would they be able to pinpoint what their password was on a specific date.

My assumption was that the current AppleID/iCloud password was the "master" that would always unlock the encrypted drive.

iMac 21.5, Mac OS X (10.7)

Posted on Apr 2, 2015 6:37 PM

Reply

Answer 1

FoxFifth

Level 10

468,837 points

Apr 2, 2015 6:48 PM in response to jdag

FileVault does not use your Apple ID password. It uses the login account password on your Mac. You also should have been given a Recovery Key and an option to store a copy of that recovery key with Apple -- although I have seen a number of reports of that not happening if FileVault was turned on as part of an upgrade to Yosemite. There is more information at OS X: About FileVault 2 - Apple Support

If you didn't get a Recovery Key it would be a good idea to use the instructions in the "Changing your Recovery Key" section of the above link.

Reply

Answer 2

jdag Author

Level 1

17 points

Apr 2, 2015 6:55 PM in response to FoxFifth

Thank you for the prompt response.

1) I think this is a matter of semantics. FileVault is not using my AppleID password per se. But the Mac itself is set up to use the AppleID/iCloud password to unlock. In my case I have not changed my AppleID/iCloud password, therefore it is the same (at least currently). My question is if I do change my AppleID password, will the FileVault password still be the one used at the time of encryption? Or will it be the new AppleID password?

2) Yes, I've seen a number of reports about Yosemite not providing the key when activating FileVault upon OS upgrade. I set up 3-4 Macs with Yosemite, and none displayed the key.

Reply

Answer 3

FoxFifth

Level 10

468,837 points

Apr 2, 2015 7:42 PM in response to jdag

Re 1) I'm not aware of a way to use an Apple ID to log in to a Mac or to use FileVault without a login password; As far as I know it is the user login password and only the user login password that is involved in FileVault. --- that could just be something I'm not aware of -- but I can't help with your question. The following may (or may not) help: OS X Yosemite: Reset a login password

Re 2) If I didn't have a Recovery Key, I would follow the steps I recommended above ASAP to get one. If you do have a problem regarding the password the recovery key is the only other option.

Reply

Answer 4

jdag Author

Level 1

17 points

Apr 2, 2015 7:42 PM in response to FoxFifth

Thanks again.

Reply

Answer 5

Linc Davis

Level 10

209,547 points

Apr 2, 2015 7:56 PM in response to jdag

There is a volume-encrypting key (VEK) that is used to encrypt the data, and a key-encrypting key (KEK) that is used to encrypt the VEK. The VEK never changes, but the KEK is derived from your password and changes when the password is changed.

Reply

Answer 6

FoxFifth

Level 10

468,837 points

Apr 3, 2015 7:26 AM in response to Linc Davis

Linc -- and by "your password" are you in agreement with me that is the user login password and not an Apple ID password? May help clarify for the OP.

Reply

Answer 7

jdag Author

Level 1

17 points

Apr 3, 2015 7:59 AM in response to FoxFifth

My confusion is that when you install Yosemite, you are prompted to activate FileVault. Also, there is a now an option to use your AppleID password as your computer password. Therefore, at least at the time of encryption, the FileVault password can in fact be your AppleID password. That was what triggered my questions about what happens if/when the AppleID password is changed.

Reply

Answer 8

FoxFifth

Level 10

468,837 points

Apr 3, 2015 8:06 AM in response to jdag

I may be adding to the confusion. I had FileVault on before upgrading to Yosemite and haven't seen that option -- or don't remember. That may also explain the lack of a recovery key. If that is the case I haven't been able to find any documentation of it but that wouldn't be the first time for that. The following is the latest I could find.

OS X Yosemite: About FileVault encryption

OS X Yosemite: Encrypt the contents of your Mac with FileVault

Reply

Answer 9

Linc Davis

Level 10

209,547 points

Apr 3, 2015 8:42 AM in response to jdag

If you change your Apple ID password, but not your login password, then the login password will still unlock FileVault. If you forget the login password, and you stored a recovery key with Apple, you can retrieve the recovery key using your (current) Apple ID credentials.

Reply

Answer 10

FoxFifth

Level 10

468,837 points

Apr 3, 2015 8:54 AM in response to jdag

jdag -- even if there was no confusion regarding login vs Apple ID or anything else discussed here, if it was me and I didn't have a recovery key in hand I would turn FileVault off and turn it back on again to get one. If I was 100% certain that I had stored it with Apple, I would probably still do that.

Reply

Answer 11

jdag Author

Level 1

17 points

Apr 3, 2015 9:35 AM in response to FoxFifth

I think I am going to do that this w/e and re-enable FileVault manually this way I get the key. I want to be sure I have all of the recovery capabilities covered.

I do find Apple's implementation of FileVault to be lacking in the details. For instance, wen you turn it on via the Yosemite install, it should clearly say that you will not receive a recovery key. But the actual messaging implies you will get a key.

Also, here is a contributing factor to the confusion. My iCloud password is being used to unlock the Mac. The Mac PW is still what was being used when I encrypted the drive. Therefore, if I change the iCloud password, and keep it "synced" with the Mac password, then my FileVault password would in fact be different (and certainly easy to lose track of down the road.

I keep my PW info very organized in 1Password, so I don't fear losing track of my information. But the other computers I help to set up (wife's, son's, niece's, friend's) would be tougher to track as I would not know if/when they change passwords.

Reply