Guest Account as Thief Trap in case of losing MacBook

Security

One week ago my MBPro has been stolen, and unfortunately no "Where's My Mac" like's helped.

My idea for securing my next MacBook is to create Password-free/guest-like account in case of another bad luck.

When thief will open the lid, he will log in, and maybe some installed software will take picture from front camera? Maybe some keylogger will help? Maybe some sneaky Prey-like software in background?
What do You think?
How to find my Mac even if my someone will reinstall the OSX?

Best Answer

There is some literature out there for you (e.g.here or here). Basically there is different means of protection.

Locating the device (Find my Mac)
Surveillance apps (also have a look at the OS X Back to my mac, which reportedly freed some Macs from their thieves)
Data security / encryption (e.g. Filevault2 encryption, Firmware password)
Physical protection (e.g. Kensington lock)

Watch out when using Filevault2 for Full Disk Encryption. This will make your data safe but will maybe not lure the thief into reveling his / her location, since only a limited version of OS X is booted.

Setting a firmware password will prevent others to boot different disks.

But watch out. These features (filevault and firmware password) require more care with backups, etc. The risk that you lock yourself out is significantly higher.

Related Solutions

MacOS – Preparing the MacBook Pro in case it is ever stolen

You want to set an Open Firmware Password. This makes it so that a thief needs a password to boot to another disk (or do anything other than a normal boot). This means that they can't reset your password from the OS disc and get in anyway. This is an important security measure to take. The only problem is that you can't do things like safe boots and verbose mode. Here is an article about how to set up the OF password (and how to reset a user password).

And here is a general article about physical and virtual options to increase security (ways to help locate a stolen Mac, make thieves think it's broken, or even just lock it to your desk).

MacBook – My MacBook was stolen: can the thief access the files without the account password

I'm sorry your MacBook was stolen. That really sucks.

Sadly, there are numerous ways to read the data ranging from removing the drive or placing the Mac in target mode. Your password only protects things when the mac is booted into your unmodified OS.

To answer your question, Physical access is total access.

It would be trivial for someone to boot using a Linux LiveCD and mount your drive, thus accessing your files. All they'd have to do to get past your sleep/password would be to hard power down the system.

Additionally, from the link above:

Mac OS X: Single User Mode

To boot a Mac into “Single User mode”, simply boot the computer and press Apple + S when blue first shows up on the screen. Next, mount the harddrive, and either dump the password and crack it with a tool like John the Ripper, or simply overwrite the root password:
# /sbin/mount -wu /
# /sbin/SystemStarter
To dump the existing root password:
# nidump passwd
To create a new root password:
# passwd root

Best Answer

Related Solutions

MacOS – Preparing the MacBook Pro in case it is ever stolen

MacBook – My MacBook was stolen: can the thief access the files without the account password

Related Question