news.volyx.in

Apple: SSH and FileVault (keith.github.io)

507 points by ingve · 311 days ago · 185 comments on HN

Article summary

When FileVault is enabled on a Mac, the data volume is locked and unavailable during and after booting until an account has been authenticated using a password. However, with Remote Login enabled, it is possible to perform password authentication using SSH even in this situation, allowing the data volume to be unlocked remotely over the network. This feature appeared in macOS 26 Tahoe. The SSH connection is briefly disconnected while the data volume is mounted and services are started, after which SSH and other enabled services are fully available.

Main themes

  • FileVault and SSH
  • Remote Login and authentication
  • macOS security features
  • Data volume encryption
  • Secure Enclave and key storage

What commenters say

  • The ability to unlock the data volume over SSH poses a potential security risk, as it could be exploited by attackers to gain access to the system.
  • Using password-based SSH authentication is not secure and should be avoided, especially when dealing with sensitive data.
  • The use of iCloud Keychain to store FileVault recovery keys is a welcome change, but some users are concerned about the potential risks of relying on a single point of failure, such as an iCloud account.
  • Some commenters argue that macOS is not a proper multi-user system, while others counter that it is capable of handling multiple users and is certified as a Unix system.
  • Storing SSH host keys in the Secure Enclave would provide an additional layer of security and prevent potential man-in-the-middle attacks.
  • The Secure Enclave is not suitable for storing and managing SSH keys due to its limited capabilities and potential performance issues.
  • Some users prefer to use alternative methods, such as Wireguard, to secure their SSH connections and protect against potential security risks.
  • The upgrade process for macOS 26 Tahoe automatically adds recovery keys to the iCloud Keychain, which some users see as a forced change in security policy that was not communicated or opted into.