Tell HN：FileVault 不保护 macOS 上的 Wi-Fi 密码
3 分•作者: turbidimeter•3 个月前
我一直不明白为什么在输入密码之前，我的 Mac 启动时 Wi-Fi 图标就会亮起。
我测试过，远离我的 Wi-Fi 网络时，它就不会亮起。
苹果的支持页面说：“使用 SSH 解锁 FileVault：在运行 macOS 26 或更高版本的 Apple 芯片 Mac 上，如果启用了远程登录并有网络连接，FileVault 可以在重启后通过 SSH 解锁。”以及“FileVault 使用 SSH 解锁以及在某些使用 FileVaultPolicy 和平台单点登录的配置中，都需要网络连接。”[1][2]
所以这意味着 Wi-Fi 密码将存储在 FileVault 加密卷之外。 （存储在哪里？）
这很酷，但即使我关闭了“远程登录”（没有 SSO/MDM），它仍然会连接到 Wi-Fi。我从未同意 Wi-Fi 密码被静默地移出 FileVault 保护。
当然，他们可能会“安全隔区”处理这件事，或者其他什么，但这不一样。
这与我在 iOS 17 中遇到的 iCloud 密码同步自动启用问题类似 [3]。
安全模型在未经用户同意的情况下被更改。不清楚什么东西存储在哪里。
他们只是决定在用户过去做出选择后，某些东西可以自动更改。
我不认为我反应过度。
这似乎是一件小事，但它表明了他们可以（并且确实）做出这样的举动。
查看原文
I was confused why the Wi-Fi symbol lights up when I boot my Mac, before I enter the password.<p>I tested this, far away from my Wi-Fi network, and it doesn't light up then.<p>Apple's support pages say "Unlock FileVault using SSH: On a Mac with Apple silicon with macOS 26 or later, FileVault can be unlocked over SSH after a restart if Remote Login is turned on and a network connection is available." and "Network connectivity for FileVault is necessary to unlock FileVault using SSH and in certain configurations using FileVaultPolicy with Platform Single Sign-on." [1][2]<p>So that means the Wi-Fi password will be stored outside of the FileVault'ed volume then. (Where?)<p>Cool, but even "Remote Login" is off for me (no SSO/MDM either) and it still connects to Wi-Fi. I never opted in to Wi-Fi passwords being silently removed from FileVault protection.<p>Sure, they might "SecureEnclave" that thing or whatever but it's not the same thing.
It's similar to the iCloud Password Sync auto-enable issue I had with iOS 17 [3].
The security model gets changed without the user's consent. It's not clear what is stored where.<p>They just decide something is okay to auto-change after the user made a choice in the past.<p>I don't think I'm overreacting.
It's a seemingly little thing, but it shows how they can (and do) just make moves like that.<p><pre><code> [1] https://support.apple.com/en-ca/guide/security/sec8447f5049/web
[2] https://support.apple.com/en-ca/guide/deployment/dep82064ec40/web
[3] https://news.ycombinator.com/item?id=38648725</code></pre>