18

Unfortunately, someone stole my laptop (a MacBook) and I did not realize that for 48 hours. Now, this was a work laptop and my company's security team is going to wipe the laptop remotely as soon as it connects to the internet. Which is nice.

However, what I am worried about is more about what could happen in those first 48 hours.

  1. My passwords were all over the place (auto-fill on my browser, etc.)
  2. My Evernote had some good amount of passwords

What I am guessing is that since it was stolen from my car, someone stealing it was interested more into selling parts of it or wipe it off and re-sell it (the hardware, not the data). At least, I hope that.

Now, in the worst case scenario, assuming it was stolen by a person who is dedicatedly interested in data: What are their options? Can they really crack open a MacBook and get my data?

If so, what are my options?

  • 4
    Given enough time and effort, in the worst case scenario, yes this would be possible. That's why we usually encrypt our drive(s) in order to prevent data leakage. In the meantime, you should change all your online passwords a.s.a.p. – Jeroen Aug 27 at 18:07
  • 34
    Evernote is not a password manager. Since you should be resetting all your passwords anyway, this might be a chance to get to use a real password manager. – Lie Ryan Aug 28 at 4:14
  • 3
    Was your mac powereed off when it was stolen? Do you have full disk encryption enabled? – Giacomo Alzetta Aug 28 at 10:11
  • 1
    What I am guessing ... was interested more into selling parts. Do. Never. Assume. – usr-local-ΕΨΗΕΛΩΝ Aug 28 at 12:08
  • 1
    @usr-local-ΕΨΗΕΛΩΝ I think you meant "Never. Assume." :) – only_pro Aug 28 at 20:11
35

Your data is probably* safe if the following three criteria are met:

  1. You have FileVault turned on (full disk encryption).
  2. Your laptop requires a password on boot and every time you open the lid (auto screen lock).
  3. Your password is not well known (easy to guess).

TL;DR;

If you don't have FileVault turned on, then your data is in plaintext and anyone can read it all.

If you had a password, and that password is required every time you open your screen, AND you had FileVault turned on (or your company did), then they need to guess your password to decrypt the data.

But, if you had a dumb password, they can probably guess it. Check out haveibeenpwned.com to determine if you had a dumb password.

If you had a strong password, file vault, and your device requires you to enter a password, then you're probably ok.

Still, why not go through your accounts and reset them anyways. Now's a good of time as any. Get a password manager like 1password and let it autogenerate passwords for you.

Choose a not-dumb password (like a truly random string of 10 characters - google a pw generator) for your password manager and memorize it.

Do the same for your new laptop password.

You'll have to memorize two crazy passwords. Write them and put them in your wallet until you do remember them.

Alternate approach is the xkcd: Password Strength method of using a few words together. I personally find this easier to remember, but more difficult to type than a 10-character random password.

(*) Having all three of those three things true makes it "very unlikely" that someone will get your data; however, a motivated, and well resourced adversary, can eventually guess every single possible password you could have uses and decrypt the contents of the hard disk. That said, you have plenty of time to rotate your passwords.

  • 18
    While I generally agree with this response, I think it could be improved in a couple of ways. First, haveibeenpwned.com serves as a way to see if an email address has been associated with "dumps" containing a potential password to the account. It does not serve as a metric to measure password strength. Instead, I would reference a list of the most common passwords, as a thief who likely does not have password cracking skills is unlikely to manually test many besides these. – svartedauden Aug 27 at 19:08
  • 9
    Second, while the suggestion of a password manager is good, I think the suggestion of a random string of 10 characters isn't in practice the ideal password for something like disk decryption or a password manager. While it's all up to personal preference, a set of words or a phrase could be easier to remember while being just as difficult if not more difficult to crack, depending on context. – svartedauden Aug 27 at 19:08
  • 19
    @svartedauden Have I Been Pwned has a password list: haveibeenpwned.com/Passwords – NobodyNada Aug 28 at 3:44
  • 8
    The important point here is Filevault! If your laptop was not encrypted, accessing everything on the drive is easily done. The password is irrelevant. – user10216038 Aug 28 at 17:53
  • 7
    @Zack The comic assumes you choose four completely random words, not a well-known phrase. – NobodyNada Aug 28 at 18:51
19

I unlocked a Mac laptop that a friend "found in a bin" without knowing the password and accessed all data on it. After a quick bit of googling I created a new account and reset the existing account password. We worked out who owned the laptop previously, called her, and to my utter surprise, she said she threw it in the bin.

It was an older laptop and about a year ago (no idea what the model was) -- no idea if it applies to your laptop.

If they can access your account then they can get all your Chrome saved passwords.

Advice: reset all your passwords. Sorry.

This link describes how to reset your password (see Use Recovery Mode)

0

Even if you format (wipe) the data, someone clever enough can still recover it, but that requires some serious skills. Try to google "recovering formatted drives".

They would still need to crack your password as macs are encrypted.

  • 9
    Not true, if the drive was encrypted, which it almost certainly was, as a corporate laptop. "Erasing" a drive with Filevault is really erasing the encryption key, rendering the data unrecoverable. – Kevin McKenzie Aug 28 at 4:05
  • 3
    formatting and wiping is not the same thing, the latter consists in overwriting every cluster on the disk, or erasing the encryption key on an encrypted drive. – Dmitry Grigoryev Aug 28 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.