The endless long tail of the post-quantum transition includes: Apple Business encrypts FileVault recovery keys to a customer-generated RSA public key.
There's a literal "openssl req -newkey rsa:2048" in the docs.
support.apple.com/guide/busine...
There's a literal "openssl req -newkey rsa:2048" in the docs.
support.apple.com/guide/busine...
Create a FileVault configuration in Apple Business
Mac computers offer FileVault, a built-in encryption capability, to secure all data at rest.
support.apple.com
July 10, 2026 at 6:26 PM
The endless long tail of the post-quantum transition includes: Apple Business encrypts FileVault recovery keys to a customer-generated RSA public key.
There's a literal "openssl req -newkey rsa:2048" in the docs.
support.apple.com/guide/busine...
There's a literal "openssl req -newkey rsa:2048" in the docs.
support.apple.com/guide/busine...
I just checked all my Apple devices to see if FileVault was on, here is how to do that on a computer:
Protect data on your Mac with FileVault
Turn on FileVault to add an extra layer of security to the encrypted data on your Mac.
support.apple.com
January 15, 2026 at 6:05 PM
I just checked all my Apple devices to see if FileVault was on, here is how to do that on a computer:
Bitlocker and FileVault everything.
Reminder: Full Disk Encryption is your friend. Encrypt with a passphrase if at all possible.
The reporter, told she was NOT the focus of the investigation, "was at her home in Virginia at the time of the search. Fed agents searched her home and her devices, seizing her phone, two laptops and a Garmin watch. One of the laptops was her personal computer, the other a Wash Post-issued laptop."
January 14, 2026 at 3:32 PM
Bitlocker and FileVault everything.
fuck filevault
November 17, 2025 at 5:06 AM
fuck filevault
A thing it is *incredibly* difficult to discover because apparently Apple just doesn't document this shit is that if you did iCloud backup of your Filevault secret, MacOS was just as vulnerable to government fuckery until Tahoe
January 24, 2026 at 4:21 AM
A thing it is *incredibly* difficult to discover because apparently Apple just doesn't document this shit is that if you did iCloud backup of your Filevault secret, MacOS was just as vulnerable to government fuckery until Tahoe
デスクトップでもFileVaultが半強制なのってつまりこういうこと？
September 20, 2026 at 7:42 AM
デスクトップでもFileVaultが半強制なのってつまりこういうこと？
(And, as far as I can tell, Filevault on Tahoe can't be recovered unless you own another Apple device enrolled with the same iCloud account, but it's really hard to know for sure because apparently THIS SECURITY CRITICAL FUNCTIONALITY ISN'T DOCUMENTED)
January 24, 2026 at 4:24 AM
(And, as far as I can tell, Filevault on Tahoe can't be recovered unless you own another Apple device enrolled with the same iCloud account, but it's really hard to know for sure because apparently THIS SECURITY CRITICAL FUNCTIONALITY ISN'T DOCUMENTED)
So basically, if the Data volume isn't unlocked and Remote Login is on, macOS will now accept SSH connections over password authentication. When you successfully authenticate a user who can unlock FileVault, it will disconnect the SSH session, unlock FileVault, and then you can reconnect with a key.
August 19, 2025 at 2:37 AM
So basically, if the Data volume isn't unlocked and Remote Login is on, macOS will now accept SSH connections over password authentication. When you successfully authenticate a user who can unlock FileVault, it will disconnect the SSH session, unlock FileVault, and then you can reconnect with a key.
Habt ihr auf euren privaten Notebooks auch alle die Festplatten-Verschlüsselung aktiviert?
#mobileDevices #luks #linux #filevault #bitlocker
#mobileDevices #luks #linux #filevault #bitlocker
February 17, 2026 at 12:13 PM
Habt ihr auf euren privaten Notebooks auch alle die Festplatten-Verschlüsselung aktiviert?
#mobileDevices #luks #linux #filevault #bitlocker
#mobileDevices #luks #linux #filevault #bitlocker
i'd give you my filevault key shreyan, i trust you
June 24, 2025 at 8:07 PM
i'd give you my filevault key shreyan, i trust you
Yeah like: password manager (not LastPass), Signal, and encrypt locally (BitLocker or FileVault, and I wouldn't store my backup key on iCloud/Microsoft) but the rest?
Like if I had to trust my life to a single consumer device OS it would not on god's green earth be Linux. (this includes android)
Like if I had to trust my life to a single consumer device OS it would not on god's green earth be Linux. (this includes android)
Not QS’ing because not to call the person out but I just saw this shared by a big account and oh god if this is the state of security education…
Anyhow sure “use Signal” and a password manager but boy would blindly following all this advice and assuming you were solid do more harm than good
Anyhow sure “use Signal” and a password manager but boy would blindly following all this advice and assuming you were solid do more harm than good
February 4, 2025 at 12:12 AM
Yeah like: password manager (not LastPass), Signal, and encrypt locally (BitLocker or FileVault, and I wouldn't store my backup key on iCloud/Microsoft) but the rest?
Like if I had to trust my life to a single consumer device OS it would not on god's green earth be Linux. (this includes android)
Like if I had to trust my life to a single consumer device OS it would not on god's green earth be Linux. (this includes android)
Behold my work machine :D
I've been using coding agents more and more, and have moved most of my work into this steam deck that's parked in our private suite in a co-working space.
I used to have it in a Mac mini, but sometimes there would be power blips that would reboot it, and due to FileVault
I've been using coding agents more and more, and have moved most of my work into this steam deck that's parked in our private suite in a co-working space.
I used to have it in a Mac mini, but sometimes there would be power blips that would reboot it, and due to FileVault
September 23, 2026 at 7:58 AM
Behold my work machine :D
I've been using coding agents more and more, and have moved most of my work into this steam deck that's parked in our private suite in a co-working space.
I used to have it in a Mac mini, but sometimes there would be power blips that would reboot it, and due to FileVault
I've been using coding agents more and more, and have moved most of my work into this steam deck that's parked in our private suite in a co-working space.
I used to have it in a Mac mini, but sometimes there would be power blips that would reboot it, and due to FileVault
FileVault keys can't be escrowed in iCloud anymore
FileVault keys can't be escrowed in iCloud anymore
If you've enabled FileVault before macOS 26 Tahoe and used the option to escrow your key in iCloud, as of 26.4, you'll be forced to...
sixcolors.com
May 18, 2026 at 5:00 PM
FileVault keys can't be escrowed in iCloud anymore
There's *one* feature in macOS Tahoe 26 that actually enticed me to upgrade. At least for one of my Macs. Despite the horrible glassy UI.
A quick video on remote Lights-Out management with FileVault on macOS Tahoe is up on Level 2 Jeff: www.youtube.com/watch?v=bSLB...
A quick video on remote Lights-Out management with FileVault on macOS Tahoe is up on Level 2 Jeff: www.youtube.com/watch?v=bSLB...
The one good feature of macOS Tahoe 26
YouTube video by Level 2 Jeff
www.youtube.com
September 19, 2025 at 6:29 PM
There's *one* feature in macOS Tahoe 26 that actually enticed me to upgrade. At least for one of my Macs. Despite the horrible glassy UI.
A quick video on remote Lights-Out management with FileVault on macOS Tahoe is up on Level 2 Jeff: www.youtube.com/watch?v=bSLB...
A quick video on remote Lights-Out management with FileVault on macOS Tahoe is up on Level 2 Jeff: www.youtube.com/watch?v=bSLB...
Do not practice anticipatory obedience. Know and exercise your constitutional rights.
Secure and protect your digital life:
Messaging - Signal, Threema, Wire.
Password Manager - Bitwarden, 1Password, KeePass.
File/OS Encryption - BitLocker (Windows), FileVault (MacOS), VeraCrypt (file level).
Secure and protect your digital life:
Messaging - Signal, Threema, Wire.
Password Manager - Bitwarden, 1Password, KeePass.
File/OS Encryption - BitLocker (Windows), FileVault (MacOS), VeraCrypt (file level).
November 25, 2024 at 10:44 PM
Do not practice anticipatory obedience. Know and exercise your constitutional rights.
Secure and protect your digital life:
Messaging - Signal, Threema, Wire.
Password Manager - Bitwarden, 1Password, KeePass.
File/OS Encryption - BitLocker (Windows), FileVault (MacOS), VeraCrypt (file level).
Secure and protect your digital life:
Messaging - Signal, Threema, Wire.
Password Manager - Bitwarden, 1Password, KeePass.
File/OS Encryption - BitLocker (Windows), FileVault (MacOS), VeraCrypt (file level).
macOS 26 has Liquid Glass, but also something way more useful, especially for headless Macs. Learn how remote FileVault unlocking and a Tailscale subnet router changes the remote access game: www.youtube.com/watch?v=833p...
September 18, 2025 at 6:36 PM
macOS 26 has Liquid Glass, but also something way more useful, especially for headless Macs. Learn how remote FileVault unlocking and a Tailscale subnet router changes the remote access game: www.youtube.com/watch?v=833p...
Apple Silicon macs store filesystem encryption keys in the Secure Enclave, so they're not available to the CPU.
If you're paranoid, you can make it even more secure: you can configure MacOS to hibernate and destroy the encryption key when you close the lid. It's slower and Touch ID won't work.
If you're paranoid, you can make it even more secure: you can configure MacOS to hibernate and destroy the encryption key when you close the lid. It's slower and Touch ID won't work.
January 15, 2026 at 9:25 PM
Apple Silicon macs store filesystem encryption keys in the Secure Enclave, so they're not available to the CPU.
If you're paranoid, you can make it even more secure: you can configure MacOS to hibernate and destroy the encryption key when you close the lid. It's slower and Touch ID won't work.
If you're paranoid, you can make it even more secure: you can configure MacOS to hibernate and destroy the encryption key when you close the lid. It's slower and Touch ID won't work.
FileVault on macOS Tahoe no longer uses iCloud to store its Recovery Key
FileVault on macOS Tahoe no longer uses iCloud to store its Recovery Key
In macOS 26 Tahoe, Apple has updated how it manages encryption keys in FileVault, the feature that protects your Mac's data volume by encrypting it....
sixcolors.com
September 16, 2025 at 3:46 PM
FileVault on macOS Tahoe no longer uses iCloud to store its Recovery Key
Michael Tsai - Blog - Tahoe FileVault: iCloud Keychain and SSH
mjtsai.com
September 22, 2025 at 8:30 PM
Uhhhhh… yeah, that's exactly why I always set up FileVault with a code and turn off iCloud option…
January 24, 2026 at 1:25 AM
Uhhhhh… yeah, that's exactly why I always set up FileVault with a code and turn off iCloud option…
In October 2024 the UK National Cyber Security Centre, published 'security tips for barristers, solicitors & legal professionals'. NCSC advised 'Turn on Encryption' & Apple's 'Advanced Data Protection'. web.archive.org/web/20241112...
On their current redirected page, the word 'encryption' does
On their current redirected page, the word 'encryption' does
March 5, 2025 at 11:11 AM
In October 2024 the UK National Cyber Security Centre, published 'security tips for barristers, solicitors & legal professionals'. NCSC advised 'Turn on Encryption' & Apple's 'Advanced Data Protection'. web.archive.org/web/20241112...
On their current redirected page, the word 'encryption' does
On their current redirected page, the word 'encryption' does
As @snell.zone documented last week, Apple now requires the use of a new (but more secure) system to manage a FileVault Recovery Key as of macOS 26.4. (Migration was seemingly optional from 26.0 to 26.3.) I explain more about how to manage the switch successfully @sixcolors.com
FileVault keys can’t be escrowed in iCloud anymore
If you’ve enabled FileVault before macOS 26 Tahoe and used the option to escrow your key in iCloud, as of 26.4, you’ll be forced to migrate to a new, better, more secure method. Jason S…
sixcolors.com
May 18, 2026 at 5:49 PM
As @snell.zone documented last week, Apple now requires the use of a new (but more secure) system to manage a FileVault Recovery Key as of macOS 26.4. (Migration was seemingly optional from 26.0 to 26.3.) I explain more about how to manage the switch successfully @sixcolors.com
I've been trolling through the macOS Tahoe man pages and I stumbled upon this.
August 19, 2025 at 2:36 AM
I've been trolling through the macOS Tahoe man pages and I stumbled upon this.