Hide "disk password" login option at EFI (Filevault) login screen
I encrypted my volume before installation and have added my user as FileVault user afterwards.
Now I can login with either the disk password or my user login password at the EFI (Filevault) login screen. (The former option sends me to the regular OS X login screen where I can again login as my user.)
How do I hide the disk password login option at the EFI login screen without enabling the input menu (com.apple.loginwindow showInputMenu -bool TRUE)?
In other words: How do I go from disk password-based encryption to login password-based encryption, at least cosmetically?
Is there maybe some option for com.apple.loginwindow that one can use? Can *.efires files be edited? Can Core Storage metadata for the volume somehow be edited?
I have the same problem when booting from an external drive, but not my internal drive!
When I boot normally, I only see a one FileVault option: me. However, when booting from my USB drive, I see two: me, and "Disk Password".
Investigating with fdesetep (sudo fdesetup list —extended
) shows that the internal drive has:
ESCROW UUID TYPE USER
BCF2ABC6-40F8-4F31-A508-7284BC85E65A Personal Recovery User
2EE7445C-13C0-497D-AD54-DA1B8D22A0F7 OS User ben
However, the external drive has:
ESCROW UUID TYPE USER
EB313C9F-E27C-41D5-9EE3-192490C792BE Disk Passphrase User
92ACE5CE-7187-44DB-92CE-56344C18568D OS User ben
Note that the external drive doesn't have a recovery key set (confirmed with fdesetup haspersonalrecoverykey
returning false
).
It looks like it should be possible to remove the Disk Passphrase using fdesetup, by doing fdesetup remove --uuid <the UUID of Disk Passphrase>
. I would strongly recommend adding a recovery key, if you do this.