8

I'm trying to get all of our laptops doing FDE (as I'm sure lots of you are), and I've run into a problematic spot. Our Windows and Linux laptops are Dells, and they have some good BIOS integration with the Seagate drives (such as the ST9160314AS). That's working well. However, on the Mac, the BIOS support (well, EFI support) just isn't there.

A coworker tried WinMagic, which claims to support these drives, but have a slew of issues that killed the project at the time (lockups, slow OS, bad interaction with FileVault). I'd really like to get it working.

Is there anything that will work for me? FileVault is better than nothing, but it slows the machines down noticeably when doing heavy IO (which is common for our users, being Java developers). One of the available software FDE packages (such as PGPDisk) would probably work, but I doubt it would be much faster than FileVault.

Also, if someone with some rep could create some tags for me (fde, winmagic, filevault), that would be awesome.

Improve this question
2
  • 1
    Hi @Bill, as you see the disk-encryption already exists. No need to create such specific product-tags, there's not enough questions on each of those to populate the tag... Besides, we usually deal here in principles, and the choice of winmagic (which you dont want anyway :) ) is mostly irrelevant to the principle of the question.
    – AviD ♦
    Jan 4, 2011 at 11:29
  • Ah, I didn't even look for disk-encryption, I started with full. Thanks.
    – Bill Weiss
    Jan 4, 2011 at 16:27

4 Answers 4

Reset to default
3

WinMagic is the only one I know that even claims to support hardware encryption, and they claim to be the only one to support Seagate Momentus drives. The Sophos/Utimaco and PGP products don't support hardware-encrypted drives, and TrueCrypt can't encrypt the boot volume.

By the way, I worked on implementing one of the FDE products listed above, and while I'm no longer associated with that company I would still advise that FDE is a better choice than FileVault. Without getting too nerdy on the details, FileVault has a kernel-userspace communication that acts as a measurable bottleneck and even causes deadlocks in some heavy-use situations. Also, it clearly doesn't protect data written outside the home folder, e.g. to the default temp location in /var/folders. Conversely, the FDE software encryption is typically all done block-at-a-time inside a kernel extension, and the vendors know that they'll get destroyed in reviews if it slows anything down :-)

As described in Apple's marketing blurb, there will be built-in full disk encryption in OS X version 10.7.

Improve this answer
2
  • Don't worry, I'm on-board with the FDE. The performance of FileVault isn't anything to get excited about.
    – Bill Weiss
    Jan 4, 2011 at 16:25
  • 2
    There's FileVault 2 now, it encrypts entire drive.
    – Display Name
    Jun 27, 2014 at 15:13
3

FWIW PGPDisk works ok on Mac OSX in my experience, had it running on a MacBook Pro with Leopard without any major issues (although I wasn't doing much in the way of heavy development with it, so hard to guage the performance hit)

Improve this answer
1
  • Good to know. I'd really like to see hardware encryption, but I'll look at PGPDisk if I resign myself to software :)
    – Bill Weiss
    Jan 4, 2011 at 16:27
3

PGP's WDE (Whole Disk Encryption) works pretty well. Its worth noting that you can use a drive encrypted with PGP WDE as a local Time Machine backup drive, allowing a fully encrypted continuous backup solution. Note - use a complex password to encrypt the drive, NOT a key.

Improve this answer
1

Current-day answer: use FilveVault 2 and SSDs. It's fast enough and works quite well. Enterprisey management isn't the best, but if it can work for you it's better than the third-party alternatives.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .