1. Encrypting in general
  1. You are protecting privacy of the information.
  1. All kinds of tools to simply hide files and folders. Basically running ‘chflags hidden <path to file or folder>’
  1. Encrypted container - Adam uses; but if you use time machine it will see the one (possibly big) file as changed and backup entire thing again. This was issue with old filevault v1 full drive encryption. It was really just home folder for each user. File was open at time and time machine would hate it.
  1. Knox, Agilebits
  1. Full disc - George uses
  2. Cross platform may or may not be an issue.
  1. Security vs convenience
  2. Why do it?
  1. Just your data? Or are you custodian for others?
  2. Do you handle medical information (HIPAA) ?
  3. Do you handle US Federally funded research (FISMA) ?
  4. If you attend or work for an EDU, search google: encryption site:stanford.edu
  1. Or call your information security group
  1. Risks of doing it?
  1. Loss of encryption key
  1. Even if personal home machine, you need to escrow the key/password for your loved ones
  1. Disk/Container level corruption could render all of encrypted volume unreadable
  2. Crossing country borders
  3. Might be illegal in your home country
  4. If you use full disk you will not be able to locate your stolen laptop. Such phone home apps and mechanisms don’t usually work before signing in.
  5. BACKUP BACKUP BACKUP
  1. Non Apple products: (If you are on 10.6 or older)
  1. Truecrypt - $FREE
  1. http://www.truecrypt.org/
  2. Free and open source but well established and maintained
  3. Cross platform
  4. Hidden volumes
  5. password vs key support. Key can be a trigger file
  1. PGP (Symantec - Drive Encryption) - $110 USD
  1. http://www.symantec.com/products-solutions/families/?fid=encryption
  2. Commercial, enterprise management
  3. Otherwise generally been getting worse year after year
  4. Cross platform maintenance getting worse
  5. George doesn’t consider this suitable for one off home users of OSX
  1. McAfee Endpoint Encryption - approx $80 USD
  1. http://www.mcafee.com/us/products/endpoint-encryption.aspx
  2. Commercial, enterprise management
  3. George has no experience with this product
  1. Filevault 2 (OSX 10.7, 10.8) - $FREE in the OS
  1. Full disc encryption - a core storage volume
  1. Internal drive, time machine drive and normal use external drives
  2. George does it on work and personal
  3. Adam does not do FDE but sticks with encrypted disc image containers
  1. Key escrow
  1. Apple
  1. Three security questions, screen shot and put in your 1password
  1. Screen shot and putting in your 1password
  2. Note for external drive these are independent passwords and are not your escrowed key with apple. So you need to record these somewhere safe.
  1. Performance
  1. Takes a good bit of time for encrypt or decrypt but fine once done.
  2. For most users no one will notice appreciable performance issue
  1. The frustrating issues (mostly gui)
  1. No progress indicator?!? really?
  1. On positive side I have not had any issues with resumption.
  2. diskutil cs list
  1. In one test I did not see a status till it had gotten a minute or two into the process and into the core storage system type
  1. Don’t care about decrypting, just want to nuke the drive?
  1. *** warning terminal and dangerous ***
  2. diskutil list
  3. diskutil eraseDisk HFS+ New disk2
  1. The buggy gui issues
  1. Had a disk that had previously been encrypted, would show on right click “Encrypting...” grayed out. But cs list showed nothing needing to be done.  I had to use the eraseDisk to nuke the drive and start over.
  2. When decrypting/encypting and right click: state is confused

 Example: When encrypting and right click: I see “Decrypting....” When the drive came back on change from old partition type to core storage type.

+-> Logical Volume Family 2B1DE245-1D97-4492-AABD-AF120C1F8592

        ----------------------------------------------------------

        Encryption Status:       Unlocked

        Encryption Type:         AES-XTS

        Conversion Status:       Converting

        Conversion Direction:    forward

        Has Encrypted Extents:   Yes

        Fully Secure:            No

        Passphrase Required:     Yes

        |

        +-> Logical Volume 64D3EA23-6E58-4C87-8FD9-FF46BE1502C3

            ---------------------------------------------------

            Disk:               disk4

            Status:             Online

            Size (Total):       3320795136 B (3.3 GB)

            Size (Converted):   379584512 B (379.6 MB)

            Revertible:         Yes (unlock and decryption required)

            LV Name:            New

            Volume Name:        New

            Content Hint:       Apple_HFSX

  1. In disk utility, holding option then clicking File. Options won’t become selectable after File is clicked, have to do alt-File at same time. But the options like turn off encryption do not seem to work.
  2. www.apple.com/feedback or a radar bug report if a developer account