0

I just got a mac and it asked me if i want to use FileVault to have an encrypted disk. I choose yes so that is setup now. I now just bought an external hard drive and I plugged it in for the first time and set it up with time machine.

I realized after it started backing up that there was an option stating: "Do you want to encrypt your backup?" and I did NOT have that checked.

So I didn't have that checked and I am trying to figure out a few things:

  1. Is it redundant to do encrypted backup from an already encrypted computer using File Vault?

  2. Given my computer is encrypted but my backup is not, does that create any problems? Is the external hard drive basically the same as if my machine wasn't encrypted?

  3. Should I chnage the time machine backup to be encrypted? Is there any downside>?

  4. Any other things to consider in this decision?

leora
  • 791
  • One of the basic issues with encryption in general, is it slows down everything. On much of todays hardware this is not as painful as 5 or 10 years ago considering the number of cores available in the CPU and amount of RAM. IMO If you encrypt the internal disk then any backup off of the system should also be encrypted, otherwise why are you encrypting in the first place. It's not being double encrypted if you do, but if you don't encrypt the backup then anyone who has access to the external backup can access its contents if not encrypted. – user3439894 Sep 24 '16 at 15:47

2 Answers2

1

In your current setup your backups are not encrypted whatsoever. That means if someone steals your external disk your data is fully accessible to an attacker. That challenges the idea of using full disk encryption / Filevault2 in the first place.

I would recommend to either

  1. Create an encrypted sparse bundle image on your external disk and use that as your backup drive. The process is somewhat tricky as it requires tinkering with the sparsebundle image. The process is explained here and here.

  2. Encrypt the external disk entirely. The disadvantage is that you will need the password to open that disk on other Macs. The advantage is that the entire content will be encrypted. To do this simply right-click the disk and select Encrypt...

Either way make sure you note the encryption passwords for Filevault and the backup disk somewhere else than on your computer or the backup disk, as you risk locking yourself out of all your data and backups.

As mentioned in the comment there is the downside that encryption slows down disk performance. That is also true for Filevault2 disk in your Mac. But Intel CPUs are pretty optimized for encryption operations these days and performance degradation should be low.

Community
  • 1
n1000
  • 7,714
  • 1
    I wouldn't recommend monkeying around with disk images- just encrypt the external disk and add the password to your keychain so it mounts at login automatically. – MacManager Oct 19 '16 at 13:49
  • I backup an encrypted (file vault) disk to an external encrypted disk on the network, but I did not opt to encrypt the backup itself. I get the "Backup Not Encrypted" warning and I guess that it's warning me that other users on the network might be able to read my backup. I am not worried about my one other user on the network. The external disk on the network is encrypted only in case it is ever lost or stolen. – Marnix A. van Ammers Nov 17 '19 at 05:30
1

FileVault 2 is a full disk encryption mechanism. Individual files are not encrypted so that is why you would need to enable it on your time machine volume. Without doing that, all your files on the backup drive would be readable.

Performance is not so much of a problem on recent machines especially with SSDs. Furthermore you are not encrypting individual files on the fly.

Hefewe1zen
  • 1,287
  • What I think is important to know and I don't see it mentioned here, is that the disk can be encrypted (or not) and the backup on that disk can also be encrypted (or not). – Marnix A. van Ammers Nov 17 '19 at 05:34