Encrypting File System Options for Mac OS X?

fieldmouse asks: "I recently had a laptop running Mac OS X stolen. Despite the fact that I got it back, that incident has me looking for an encrypting file system for Mac OS X; preferably one that would create a psuedo drive that I could unlock once when I log on. Anybody have any suggestions?" About 2 years ago, Ask Slashdot did the Linux version of this question. Has this gap been filled in Apple's latest OS offering?

Comments

Disk Image?

[Drizzt Do'Urden]

Create an encrypted disk image with Disk Copy, make it writable, and drop your sensitive data in it ;)

Use Disk Copy and stay neat

[Paul Burney]

The application/system items on the drive don't need to be encrypted of course so just create a new disk image in disk copy, choosing the 128-bit AES encryption option. You will be prompted for a password to use. (Don't save it to the keychain, duh.) You will have to enter your password twice when you open the image.

Now be very careful with your documents/items and always save them to the encrypted disk image.

The other benefit is that keeping all your important things on that image allows for easy backups.

Re:Use Disk Copy and stay neat

[Parsec]

They will be mutually incompatible. You can't use PGPDisk with Classic in X (fails to mount) and you can't use AES images in MOS9.

To convert, you'll have to copy your data out into unencrypted space via PGPDisk in MOS9, boot into X to copy your data into an AES image, and do a good wipe of your unencrypted data. The AES image can also be stored and mounted from a server, while PGPDisk didn't like that.

Re:Use Disk Copy and stay neat

[nickovs]

Disk images in OS X can be mounted with the hdiutil command. I've never tried mounting an encrypted disk but given the way that Apple implement their crypto using CDSA I expect that it will simply offer up the usual dialogue boxes and let you type in the key (since the prompts for passphrases to CDSA are generated by the kernel code).

Re:Use Disk Copy and stay neat

[nickovs]

Just to confirm, if you type hdiutil mount imagefile.dmg on an encrypted image you get a prompt to enter the passphrase and it then mounts successfully. I can not see a simple way to provide the passphrase from a program but you might be able to do it with some careful AppleScript. Of course this would totally negate any security if you kept the passphrase in the script.

A Simple Solution

[PastorOfMuppets]

Use Disk Copy (located in the Utilities folder) to ccreate an encrypted disk image and add that image to you "Login Items" in the Login Prefrence Pane.

Disk Image

[mlknowle]

I made a 200mb disc image using Apple's (built in) Disk Copy app, and enabled the encryption options. I keep sensitive docs and client notes on it; whenever I need it, I open the disk image, type my passphrase and the disk pops up like any other removable media.

When I'm finished, I just eject it. How secure is this? I'm not sure what function Disk Copy uses for encryption, but it is enough that if my laptop were stolen, I'd worry about the computer, not the data.

Crypt

[xinu]

I'm going to post this again, but with a link this time.

Look at Crypt using Blowfish and all that jazz.

Running Solaris as an Admin I have crypt encrypt some docs upon .login and upon .logout for some documents. Never tried it for OSX but I don't see how it should be any different other then it's going to pop up a GUI asking for your passwd.

Following the UNIX and Perl mantra, there is always another way of doing something...

CFS

[Anonymous Coward]

Use Matt Blaze's CFS. It supports encrypted (3DES) volumes, with timeout support among others. It's NFS loopback mount, so it will work on pretty much any UNIX -- including MacOS X and *BSD. NetBSD has TCFS which is AFAIK more tightly integrated (at VFS level).
Get CFS here: http://www.crypto.com/software/

Advance Encryption Standard (AES)

[stux]

http://csrc.nist.gov/encryption/aes/aesfact.html

(or you could just mod up the previous guy ;))

Including the all important "What is the Advanced Encryption Standard (AES)?"

Disk Copy with second keychain

[ekc]

As others have mentioned, Disk Copy is definitely the way to go for creating a password-encrypted volume in Mac OS X. You can make the disk images as large as you want, they are functionally pretty much indistinguishable from normal volumes, and there's no reformatting involved.

I just wanted to add one point about storing your passwords that makes life even simpler. Try using Keychain Access to create a second keychain you call "secure" or something to that effect. Make this temporarily the default keychain so that when you create your disk images, you can store the passwords to this new keychain. Configure the keychain so that it will relock itself after a short period of time (say 15 minutes), then set the default back to your regular keychain.

That way, you need only enter the password once to have access to every encrypted disk image, and in my experience, by the time you're done and you unmount the volumes, everything will be locked again!

Re:also Open Firmware Password utility

[usr122122121]

If you try to boot from another partition, CD, or external drive, you're presented with a very plain password screen with no instructions. I then have the screen saver set to require my password to get back to the finder. it's not obviously quite as secure as encrypting an entire volume, but is fairly secure.

The open firmware password method is a very useful if you are limiting physical access to the computer... however, if the computer was stolen, you don't have that sort of control.

The thief could very easily remove the hard drive from the computer and place it into another one to circumvent Open Firmware Passwording. Thus, in addition to Open Firmware Passwording you must also have some sort of encryption to safeguard the files on the disk.

Recovering Stolen Goods

[mumkin]

Nice to hear that fieldmouse's laptop was returned, but it begs the question: how did you get it back? Since you were successful in this, I'm interested in whatever actions you took beforehand/afterward which facilitated recovery. Or was it just dumb luck? Tips to help the rest of us prevent/deal with a theft?

Show me the code

[bckspc]

For keeping your passwords safe from the average laptop thief, Disk Copy is probably fine. But for protecting your sensitive info from The Man, I'd be just a little wary of proprietary packages. Has anyone seen the source code for Disk Copy? Are you absolutely sure that there are no backdoors for law enforcement? Apple would stand up to the Feds in defense of their loyal customers, right?

Depending on the level of security you're after, I recommend open source software that's been audited by lots of paranoid geeks.

--
Design + Activism