my macbook pro was stolen i locked it - can thieves still access my keychain etc

Question

Level 1

7 points

my macbook pro was stolen i locked it - can thieves still access my keychain etc

Yesterday some scumbag broke into my flat and made of with my MacBook Pro. I used find my MacBook, locked it and left a message. I got a message today telling me it's location and that it was now locked. What does that mean though? Is it easy for common thieves to bypass the locked mac? And can they still access my keychain with all my passwords etc?

I reported all this to the police and I've already been set up with a brand new replacement. Is it worth me now just erasing the stolen MacBook?

Thanks in advance

Al

Posted on Feb 18, 2017 10:13 AM

Reply

Answer 1

ajscott83 Author

Level 1

7 points

Feb 20, 2017 2:10 AM in response to Kappy

You would hope so, but if you look on youtube there appears to be ways round this. I was quite shocked at just how easy it is to reset the start up/screen lock password.

The thieves must have got passed the initial screen lock password as they changed the name of my MacBook to the wonderfully creative 'Macs Macbook air' which is a bit weird as it isnt a macbook air. Then they must have connected to the internet, and thats when the lock kicked in.

I did also have FileVault activated on my MacBook, i think anyway, it was a 2014 model which i think has FileVault as standard. Anyway, i changed all my passwords and passed on the last known location of my MacBook to the police. I doubt i'll ever see it again.

Reply

Answer 2

Drew Reece

Level 6

10,684 points

Feb 19, 2017 7:33 AM in response to ajscott83

I don't believe the Mac is totally inaccessible once locked. What is stopping the thieves removing your HD & reading the data from it? The only way to prevent someone accessing data like that is to use encryption BEFORE it is stolen - that means enabling File Vault on Macs.

The lock may stop most thieves but anyone with the motivation can try to find your data. The keychain is password protected with your user account password - how good was that? If you used a common word or something that can be found within your user account it could be accessible via dictionary attacks on the keychain.

I'd recommend you look at your backups to see what accounts are in the keychain. Then change the passwords on those accounts - it is the best way to prevent anyone accessing via the data on the missing Mac.

It is unlikely but you have to take steps to protect your data if you think it has been compromised. Resetting the iCloud password will stop the Mac connecting to your account (so it stops syncing data to iCloud etc). I believe it still can be locked or tracked via 'find my…'

Reply

Answer 3

Drew Reece

Level 6

10,684 points

Feb 20, 2017 10:00 AM in response to ajscott83

FileVault is included in the OS, but not enabled by default. It requires a good password to be effective by definition a 4 digit pin is not that! There are also recovery options that are essential to using FileVault, you should see that when setting up FileVault.

Please read the titles of the YouTube videos - there are multiple 'locks' on the OS…

EFI password

iCloud lock

User account password

FileVault

It is easy to misunderstand each of them.

Some are illustrated at…

https://support.apple.com/en-us/HT204156

Reply

Answer 4

Drew Reece

Level 6

10,684 points

Feb 20, 2017 8:03 AM in response to ajscott83

FileVault is not 'standard' on any Mac that I know of. I'm afraid that your Mac didn't have that feature enabled.

The normal user account password can be defeated very, very easily which may be what you saw on YouTube. FileVault would prevent them changing the computer name without the password.

Reply

Answer 5

ajscott83 Author

Level 1

7 points

Feb 20, 2017 9:02 AM in response to Drew Reece

My new macbook that i received yesterday had FileVault included in the initial setting up of the new laptop, i assumed the last one did to.

Ok, so the actual lock that requires a 4 digit pin to unlock is more robust than the normal user account password, thats good to know. Although there are quite a few videos on Youtube that claim to be 'how to guides' on unlocking the 4 digit code. https://www.youtube.com/results?search_query=macbook+lock+4+digit+pin

thanks.

Reply

Answer 6

Feb 18, 2017 1:53 PM in response to ajscott83

This won't help with the current situation but I would highly recommend turning on FileVault on the replacement: https://support.apple.com/en-us/HT204837

Reply

Answer 7

Kappy

Level 10

361,995 points

Feb 18, 2017 10:16 AM in response to ajscott83

It should not be accessible if you locked it. At least that is how I understand it.

Reply