ICloud – FileVault Encryption Issues On High Sierra (APFS)

apfsencryptionfilevaulthigh sierraicloud

I've recently updated to High Sierra and am now having issues with the encryption of my SSD.

When upgrading I was prompted to create a new password for my user account, the dialog saying that I couldn't use the same password as my iCloud account anymore. This led to when I restarted my MacBook Pro, I had to log in twice. Once for the disk encryption, and one for the user account. This wasn't ideal for me, so I contacted Apple support to ask about the issue. They were only able to help me roll back to a previous Time Machine backup from before I updated, so now I'm running Sierra again.

I suspect the option to use your iCloud password in conjunction with your user account (and other things…?? FileVault?) is what has caused the issue. Now that I'm up and running again on Sierra 10.12.6, I don't even see it as an option when I go to system preferences.

My question is, what is the best way for me to proceed to:

Have an encrypted SSD
Run the latest version of macOS (High Sierra)
Have as few passwords as possible (though I can use 1Password to store them if I need many separate passwords, it's just more messy.)

Best Answer

If you have an encrypted drive before installing the OS you get that multiple login issue. If you do an install on a standard drive, then turn FileVault on, you won't have to double log in, as the user login will 'decrypt' the drive on its own.

I believe that's what solved a similar issue for me. I did a second clean install, this time formatting APFS (without encryption).

Related Solutions

Hide “disk password” login option at EFI (Filevault) login screen

I have the same problem when booting from an external drive, but not my internal drive!

When I boot normally, I only see a one FileVault option: me. However, when booting from my USB drive, I see two: me, and "Disk Password".

Investigating with fdesetep (sudo fdesetup list —extended) shows that the internal drive has:

ESCROW  UUID                                                                     TYPE USER
        BCF2ABC6-40F8-4F31-A508-7284BC85E65A                   Personal Recovery User
        2EE7445C-13C0-497D-AD54-DA1B8D22A0F7                                  OS User ben

However, the external drive has:

ESCROW  UUID                                                                     TYPE USER
        EB313C9F-E27C-41D5-9EE3-192490C792BE                     Disk Passphrase User
        92ACE5CE-7187-44DB-92CE-56344C18568D                                  OS User ben

Note that the external drive doesn't have a recovery key set (confirmed with fdesetup haspersonalrecoverykey returning false).

It looks like it should be possible to remove the Disk Passphrase using fdesetup, by doing fdesetup remove --uuid <the UUID of Disk Passphrase>. I would strongly recommend adding a recovery key, if you do this.

MacOS – Convert between FileVault 2 and Disk Utility encryption

As it turns out, I found the answers to most of this not long after I asked the question. The command-line fdesetup program offers some additional options.

Removing Disk Password

Run sudo fdesetup list -extended and look for the UUID labeled "Disk Passphrase". Then run sudo fdesetup remove -uuid <UUID> to remove it.

This can be used to remove the disk password that was created via Disk Utility, leaving only user login passwords for unlocking the disk.

Removing User from FileVault

Run sudo fdesetup list (-extended isn't needed) to see what users are authorized to unlock the disk, then use sudo fdesetup remove -user <USER> or sudo fdesetup remove -uuid <UUID>.

This can be used to de-authorize users so that only the disk password can be used.

Adding Recovery Key

Run sudo fdesetup changerecovery -personal. This will prompt for a password (anything that's currently enabled to unlock the disk), then display the new recovery key. (Write it down!)

Removing Recovery Key

Run sudo fdesetup removerecovery -personal. As above, this will prompt for a password.

Adding Disk Password

I couldn't find a way to do this in-place — sudo diskutil cs passwd seems like it ought to work, but it requires there to be an "old" disk password already.

However, you can turn off FileVault using the preferences window (which decrypts the disk), then use sudo diskutil cs encryptLV <UUID> to re-encrypt it with a disk password. This is slow, since it has to decrypt and re-encrypt all the data, but it works.