Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have used Mac's Open Firmware password protection before and I've always wondered how effective it actually is at protecting my stuff.

[assuming a good password]

  • Would does the firmware password prevent others from doing?
  • Is it worth the hassle of having to deal with it?
  • How easy is it to get around the firmware password protection?
  • Is having a firmware password a best practice?
share|improve this question

2 Answers 2

up vote 9 down vote accepted

"Would does the firware password prevent others from doing?"

It stops people who have access to the machine from booting into other partitions, target mode or single user mode. For me this is huge. If you're not encrypting your primary partition, a user could simply sit down at the machine, target boot it and grab anything from your machine. Along with that, a user could boot into single user mode and create new admin accounts allowing persistant access to the machine without the user being any wiser.

"Is it worth the hassle of having to deal with it?"

Depends on your environment. For me, I think it fits for either A) highly accessible machines or B) highly valuable (data-wise) machines.

"How easy is it to get around the firmware password protection?"

If you replace the memory on the machine the firmware password gets removed. So to get by it a person would have to have prolonged access to the machine and the know how to do a hardware swap.

"Is having a firmware password a best practice?"

Again, it depends. I think the highest end security you can provide is encrypted drives with open firmware passwords. That way if the user does have prolonged access to the machine, they can remove the open firmware password but still not read any data. But that's the high end. You have to weigh the difficulties of implementation of this against the damaged that would be done by have a users data lost. Again, think of how likely it will be for users to have prolonged access to the machine and how important the data on there is.

share|improve this answer
    
Great answer! Exactly what I was looking for. Thanks! –  Mike Grace Nov 20 '10 at 17:27

Staros makes some good points. In addition, notice that the open firmware password is very lightly obfuscated, so anyone who can read the nvram data can retrieve it. That may not be true for the Intel EFI password feature.

share|improve this answer
    
Good to know. Thank you. –  Mike Grace Nov 20 '10 at 17:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.