Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm configuring my mac and encrypting my disks with FileVault 2. As the boot disk is encrypted at startup I have to login via the EFI partition before the OS will boot.

From my understanding, most people who have investigated FV2 think it's a pretty decent FDE solution. However it appears to be vulnerable to keyloggers.

As my login is linked to the encryption keys, access to my login credentials will give access to my disks. As mac doesn't (easily/readily) support two-factor login, then an attack against my password will suffice, correct? Should I fall victim to malware with a keylogger, the entire security of my mac is compromised.

The question then, is this a valid attack vector and anything to be concerned about? Are keyloggers a real threat? I've read that there are no reported cases of keylogger malware for mac, but I'm unsure how old or valid those reports are now.

If it's valid - is there any recommended safeguards?

share|improve this question
up vote 0 down vote accepted

Key loggers exist and they are in fact a real threat.

Encrypting a disk is not so much about making sure your disk isn't vulnerable to trojans and malware that works across a network. Rather, its about ensuring that if your laptop falls into nefarious hands that the attacker cannot read your computers data using a live disk or some other means to bypass any sort of login all together.

However, it is possible your attacker could key log your computer before hand then get his hands on it and crack it like that.

share|improve this answer
Yes - this is the attack vector I'm thinking of - it seems unlikely, especially for a home PC, and not that I think anyone is particularly interested in what I'm doing... Would like to see Apple add two-factor logins (especially for remote macs) - I'm wondering if, in this case though, a combination of security sw such as sophos + little snitch firewall would give a good warning something was wrong? – SockThief Oct 11 '13 at 19:54
Little snitch lets you know any connection thats leaving your network so I supposed that would help. I'm not a big fan of Antivirus on mac since its based on Unix and pretty secure in its own right. This could be ignorance on my own part though. – redIago Oct 11 '13 at 22:58
Little Snitch seems to be the best way to catch anything that wants to phone home – SockThief Oct 15 '13 at 13:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.