Nancy, while I am all for keep our data safe, I think you have given FileVault short shrift. It is true that in its original incarnation FV was problematic and did not work well. Those bugs have been ironed out and fixed and now FV works as advertised.

There are two major things about using FV that you did not mention that you should have. 1 is that FV is intended for mobile users. This does not mean that owners of non-mobile Macs can't use it, but they won't see as much value out of the feature as mobile users might. 2 is that FileVault only encrypts your data when you are logged out of your account. When logged in your data is unencrypted just like if you were not using FileVault.

So if you are a mobile user, like I am, that wants a higher level of security when you are commuting then you should turn on FileVault. If your Powerbook or iBook is every lost or stolen, and you are logged out of your account, then if anyone tries to access your data they will not be able to.

This is the value of FileVault.

FileVault persists in creating damaged disk images to this day on Apple Discussions. Many use it obviously who don't know how to take care of it, but the risk of data corruption is too high I believe to put your entire Home folder in a secure mode. It is the "all your eggs in one basket" issue. The Disk Utility image option is much safer, and much easier to create more than one copy, than an entire home folder. FileVault I believe was misconceived from the beginning.

I disagree. It is not that FileVault is "misconceived" so much as people don't know how to use it. If you do not let FV recover file space when it needs to then yes, you're going to wind up with damaged disc images, corrupted data, lost data, etc. Just like any software tool, if it is used correctly and with a little common sense, then FV is a valuable way to keep your Home directory encrypted and safe.

As I pointed out in my original post, though, FileVault isn't really intended to be used in a desktop environment. Knowing that it would be much better to use encrypted disk images created with Disk Utility to encrypt files, or to use something like PGP or GPG to encrypt individual files.

klaatu wrote: "So if you are a mobile user... that wants a higher level of security... then you should turn on FileVault."

And you neglected to mention the specific drawbacks of using FileVault:

1) as FileVault stores your entire home folder in a single, encrypted file, any file or disk corruption may trash your entire home folder and there are no tools available to recover data from an encrypted volume that has been corrupted. It's easy to act smug and tell someone who's lost all their data that they should have backed up regularly. The practical challenges of doing so on a regular basis, especially with large amounts of encrypted data, are rarely discussed. Remember that some people use their notebook as their primary/sole computer and that they look to FileVault to protect their data all around, not just when traveling. - An incomplete security solution is like installing a door lock worthy of Fort Knox on your front door, only to have a burglar easily slip in through a broken window in the rear.

2) Details of Apple's implementation of encryption in FileVault is not publicly disclosed, which means that no matter how secure the encrypted volume may be, slip-ups in how your password is handled by the OS, in and out of virtual memory, and in event your Mac goes into Sleep mode, may create a way for a highly motivated snoop to figure out your password and access your data. The only way to satisfy this concern is for Apple to publicize the details of how this is all handled and therefore make it subject to peer review.

3) Performance. While FileVault's performance hit may be minimal on a fairly new computer running most software, you will have a huge performance hit for certain tasks such as video and video editing.

gopher wrote: "The Disk Utility image option is much safer, and much easier to create more than one copy, than an entire home folder."

Yeah, except for the fact that an encrypted volume in OSX has a fixed size, making it difficult to work with when you run out of space, at which point you have to recreate the volume from scratch. Result: You end up either having to go through this ridiculous process repeatedly (and exposing all your unencrypted data to the disk) or you have to create a ridiculously large encrypted volume to accommodate all the data you think may even be stored there.

Quote

Guest wrote:


And you neglected to mention the specific drawbacks of using FileVault:

1) as FileVault stores your entire home folder in a single, encrypted file, any file or disk corruption may trash your entire home folder and there are no tools available to recover data from an encrypted volume that has been corrupted. It's easy to act smug and tell someone who's lost all their data that they should have backed up regularly. The practical challenges of doing so on a regular basis, especially with large amounts of encrypted data, are rarely discussed. Remember that some people use their notebook as their primary/sole computer and that they look to FileVault to protect their data all around, not just when traveling. - An incomplete security solution is like installing a door lock worthy of Fort Knox on your front door, only to have a burglar easily slip in through a broken window in the rear.

Please correct me if I'm wrong but it sounds like you are saying here that because backing up data is a pain you shouldn't use FileVault. Is that correct? I have no difficulty backing up my Home directory every week (and more often if I think I need to) because when I am logged in the data is <i>not encrypted</i>. I use my powerbook as my sole computer and backing up my data is easy. I don't understand your argument at all. If you just don't like using FileVault that's fine, but saying it is difficult to backup data when using it is just plain wrong.

Quote

3) Performance. While FileVault's performance hit may be minimal on a fairly new computer running most software, you will have a huge performance hit for certain tasks such as video and video editing.

There is no performance hit when using FileVault because the data is encrypted and decrypted only at log out and log in. While you are logged in the data is fully decrypted. There is no encryption going on while a user is logged in to an account.

When using FileVault I recommend that people not keep things like large digital video files or large collections of music in the Home directory. This can cause large delays in encrypting and recovering disk space when logging in and out. But this is just my opinion on where to keep data like that. If someone on a laptop wants to keep digital video files in their Home folder they can. I don't.

[quote="klaatu"]

Quote

Guest wrote:

There is no performance hit when using FileVault because the data is encrypted and decrypted only at log out and log in. While you are logged in the data is fully decrypted. There is no encryption going on while a user is logged in to an account.

When using FileVault I recommend that people not keep things like large digital video files or large collections of music in the Home directory. This can cause large delays in encrypting and recovering disk space when logging in and out. But this is just my opinion on where to keep data like that. If someone on a laptop wants to keep digital video files in their Home folder they can. I don't.

Not true. Filevault encrypts and decrypts on-the-fly, and this does create a quite large performance hit when using iMovie or similar apps. Don't believe me? Check out Apple's article on the subject - http://docs.info.apple.com/article.html?artnum=93460Ð’

I think you may be misunderstanding what Apple means by the term "on the fly" in that article. It is understandable, since it is an ambiguous term. What they mean by that term is that files in the Home directory are encrypted and decrypted "on the fly" when the account is logged in or out. Both that article and the FileVault page <http://www.apple.com/macosx/features/filevault/> should be edited to be more clear.

I'm not trying to convince you to use FileVault if you don't want to. But there are some misconceptions about FV out there and hopefully we can clear them up.