News for hackers. Stuff that matters.

A comment on Potential impact of the Intel ME vulnerability. Parent comment

Re:Potential impact of the Intel ME vulnerability by wpowiertowski on Monday November 27, 2017 @09:08PM (#15793655)
FileVault does not require a password input at EFI. It decrypts user data in memory after user login
[ Parent | on HN ]
Re:Potential impact of the Intel ME vulnerability by tempay on Tuesday November 28, 2017 @02:22AM (#15795143)
I thought current versions of FileVault encrypt the entire OS and the login screen is just a fancy boot partition?
[ Parent | on HN ]
Re:Potential impact of the Intel ME vulnerability by Tsiklon on Tuesday November 28, 2017 @04:21AM (#15795633)
You're mostly correct.

On a CoreStorage Filevault 2 system, the Recovery HD is used as the boot loader, calling an EFI program named "boot.efi" present on the filesystem.

On a APFS system things are a bit different; the Recovery HD is still used, however this is now a Logical volume presented from the main volume group, with the update to High Sierra a Firmware upgrade was pushed out to all supported systems enabling the EFI to grok APFS.

Edit removed terminal output

[ Parent | on HN ]