Encrypt drive and mount /boot on a usb/sd card for TFA?
I recently inherited my wife's old mid-2010 (7,1), which I'm in the process of upgrading. I'm relatively unfamiliar with Macbooks, and I was wondering about setting it up in ways similar to my other machines running Linux.
I have FileVault turned on, but I was wondering if it's possible to take the security one step further by mounting the boot volume on a usb or sd card. That way the machine would only boot if the said volume was inserted AND the correct password was provided.
I'm not sure if macOS has a utility for achieving this, or if it can be setup this way at all. It appears that Apple's "Fusion Drives" implement a logical volume management scheme that is presumable capable of this, but I'm not sure if this older Macbook is compatible or not.
Any advice/resources will be greatly appreciated! Thanks!
Posted Dec 18, 2018, 5:21 AM UTC
Security by obscurity? I don't know about that...
I mean... Name a scenario in which this would help beyond what FileVault already does for you.
Beyond what FileVault does (which is require a password to decrypt the /root, /home, and other partitions; FV doesn't encrypt the boot partition), it requires that the usb key be inserted to even know what/how to boot. In the event that the Macbook gets stolen or seized by authorities, not only can the machine not be booted, but the data on the drive remains entirely unreadable. With the boot partition/boot record stored externally, it is possible to completely hide how the hard disk is partitioned and configured. It makes it harder to penetrate the system without sacrificing all the data on the disk. I understand that these aren't common needs to typical users. I want to learn about these machines and their capabilities.
[deleted]
I'm likely misunderstanding what the threat model is we are trying to protect against, here. I'd like to learn more about it, if you know of any good resources to read.