filevault

FileVault is closed source, so there is no guarantee that Apple doesn't have a backdoor built into it.

Imagine if BitLocker/FileVault had a mechanism like that, which could be forced on users by corporate policy!

But yes, this is not possible with a firmware password or with disk encryption (FileVault) enabled.

Yosemite already moves any machine it upgrades to Core Storage, even if you don't use FileVault.

There has been some analysis of FileVault FDE, as well as an implementation of an open source library to read it.

You cannot reset any user password on a FileVault disk because it's encrypted.

FileVault is typically not tied to the root password, but to a primary user's password, which you don't even need root to change.

OS X's whole-disk encryption (FileVault 2) similarly creates a recovery key at encrypt-time.

Apple has made it easy for people to encrypt their drive with FileVault, which is a huge step forward for privacy and security.

I don't think you can boot the machine to login as Guest without a password if you have FileVault enabled.

They tried to get my administrator password (because I use FileVault) and I refused.

If you use FileVault, they specifically need your administrator password.

"Gee, I had my FileVault turned on but somehow the authorities were able to decrypt the whole damn thing!") And wouldn't Apple be destroying the product's reputation and severely harming their own reputation by providing that backdoor access and having it hit the news?

> You Don't Want XTS > If you’re an end-user looking for crypto advice: use Truecrypt, use Filevault, use dm-crypt.