encryptionmacostime-machine
I am thinking about upgrading to Mac OS X 10.7 Lion, because it offers full disk encryption.
However, if I use Time Machine with on an external hard drive, will the Time Machine backups be encrypted as well? If not it seems to defeat the purpose of whole system encryption. :p
Also, if the Time Machine backups can be encrypted, how does it handle restoring from a Time Machine backup onto a new system?
No, the backups will not be encrypted automatically, but it's very easy to enable for directly attached disks. Just check "Encrypt Backup Disk" in the Time Machine disk selection settings.
If you're backing up to another Mac, you can use Disk Utility on that Mac to erase non-boot drives and put an encrypted partition on them:
To answer your first question about the keychain and whether you should encrypt backups: the passwords in your keychain are already encrypted, that's why you always have to type a password (by default your login password) to show stored passwords. So there's no immediate need to encrypt.
Of course, you could add Time Machine encryption to provide a further layer of security. This is possible starting with OS X Lion and Mountain Lion (from http://support.apple.com/kb/ht1427):
OS X Lion and Mountain Lion let you encrypt the Time Machine backup external drive using FileVault 2.
FileVault2 also uses your login password, though. So if the bad guys are able to guess or crack that password, they will have also access to your keychain information. Choosing different passwords for login and for accessing your keychain would protect the keychain passwords in such an event.
Either way, use strong passwords, password quality is of foremost importance to protect your data.
EDIT:
The OP asked in a comment how to set different passwords for login and keychain. Here is how:
Open Utilities>Keychain Access.
Right click each keychain and select 'Change Password for Keychain XYZ':
If you prefer to use your current password as keychain password and change your login password, log in using another account and change your account's password from System Preferences>Users & Groups. That will only change your login password, not your keychain password.
Best Answer
It took me a little while to find the "Encrypt backup disk" checkbox, so I thought an answer explaining that may save you some time.
Press the "Select Disk…" button in the Time Machine System Preferences panel, and the "Encrypt backup disk" checkbox is enabled when you select a disk.
I decided not to encrypt my Drobo after reading Alrescha's important note about not being able to use an encrypted disk with older versions of OS X than Lion.
But I was curious to see if Apple would warn me:
(See also "If I encrypt a Time Machine backup disk, is the entire disk encrypted or just the Backups.backupdb directory?".)