codedil wrote:
Hi @Barney-15E, let me try one last time :
Leave all your assumptions and try to understand it once again from the start.
Please do not sit on your point that user have failed to prepare for the disaster. That's already given and that's why he is here and trying to highlight that he wasn't even warned. He has followed the resetpassword steps as mentioned in the document as he wasn't getting the reset instructions in the login window. This is already highlighted couple of times in the previous replies. You can call it ignorance, but it's a fact that he wasn't aware of FileVault, he still doesn't understand it fully. Don't remember enabling it explicitly. He only learnt about it through support or reading about it later. And don't really know - why he is getting 'Activate Mac' if not for filevault (as you are saying). And unfortunately he didn't have FinedMyMac Enabled, which might have triggered this flow as per his understanding, which definitely can be questioned. It's not like he has broken the harddrive or burnt the MacBook and asking Apple for some solution. Some weird flow triggered because of different circumstances and trying to see if Apple really designed it this or if this is a flaw or miss.
Now with that, Can you answer me these two questions, in simple words as you can :
1. In the initial reply you told the current 'Activate Mac' screen I am stuck in is not related to Filevault. And you would try resetting the password again. How to do that ?
I would startup in Recovery and use Terminal to run resetpassword again, but I have no idea how you arrived at that screen. It looks like what happens when you set up a new Mac. That may be what it is doing since it cannot decrypt the drive. Resetting the password won’t change anything, though, for the reasons already outlined. You can change the password using that method over and over, but it will not release the decryption keys. That makes zero sense from a security standpoint. It is very likely you will need to erase it and start over. If it is an Apple Silicon Mac, there is this concept of an “owner” which has to be reset. That is what appears to be happening, but I don’t know if you have an Apple Silicon Mac.
2. Do you have any strong reason that Apple should not warn or stop user from using the ‘resetpassword' flow in terminal in Recovery Mode?
I don’t have any reason to think Apple should do that. It’s obviously a last resort option. You are not in this situation because you used resetpassword. You are in this situation because you forgot the password that would allow decryption. Whether you enabled FileVault or not is irrelevant because all modern Macs are always encrypted. Allowing anyone to startup in Recovery, use Terminal to reset the password, and then allow decryption is a security failure.
Why not add a step to verify the ownership there itself ?
How would that help you? You have no means to do so as it stands. How would you solve that problem? What scheme do you propose that would somehow provide the authentication not already implemented?
resetpassword is a very old utility that makes little sense in the current macOS security scheme.
Again, we can do nothing to affect Apple’s policy. You can submit feedback suggesting they dream up another way to authenticate the user.
They did have a method to reset a firmware password in the store, but doing something like that for the decryption keys opens them up to being forced to decrypt someone’s Mac. I certainly don’t want government to have that power.
It should serve the both purpose of stopping wrong people taking over and also the nudge or push actual owner to double check if he really wants to proceed with this flow ?
Again i request you leave your emotions and passing statements in your reply.
I understand that you are emotional about this, so that may be clouding your response. I’m just stating what is. You are converting that into emotions.
Leave all your assumptions about what user should have known and should have done.
That’s the heart of the matter. You want an option to recover after you failed to implement existing recovery options.
User is an individual, Apple is a system. What user did wrong or missed doing affects him, what apple did wrong or missed doing affects the System.
Why do you assume Apple did something wrong? To me, it sounds like they did everything correct. They created a security system which has several recovery options, but prevents recovery by someone who stole the device.
Because we are trying to highlight what apple could have done that prevented me, owner of the MacBook, ending up in this situation. Thank you.
Again, there is no one here that can answer that question. You are asking for a discussion on Apple’s design, policy, and future activities. We do not work for Apple. We have no control over what they do. However, Apple already provided the means for you to not end up in this situation.
