destroyfvkeyonstandby requires additional pmset settings in order to avoid system shutdown

I’m wondering if anyone has tried the combination of OSX Login via Yubikey (https://www.yubico.com/why-yubico/for-individuals/computer-login/mac-os-login/) with the pmset -a destroyfvkeyonstandby 1 system configuration enabled to destroy the file vault key.

I have both of these set on a machine, and when I put my computer to sleep, upon waking it later I often find that the system has turned itself entirely.

I suspect that this is because of a negative interaction between these two configurations – that removing my YubiKey during the sleep process is depriving the system of something it wants in order to stay on while the FileVault key is no longer accessible.

Similar experiences or suggestions on how to troubleshoot this are welcome.

[kun-zhou]

I suppose that’s where Linux excels when you want to hack things around, I am so done adjusting these setting…. But macOS and its huge trackpad is just so intuitive comparing to any Desktop Environment on Linux or PC trackpad and I am willing to sacrifice security for convenience.Just make sure keep your laptop with you most of the time.

[kun-zhou]

I am on Sierra 10.12.4 with late 2016 Macbook Pro without touchbar. It seems like my computer is still not sleeping and waking properly. Here are my settings:

System-wide power settings:
 DestroyFVKeyOnStandby		1
Currently in use:
 standbydelay         0
 standby              0
 halfdim              1
 hibernatefile        /var/vm/sleepimage
 powernap             0
 gpuswitch            2
 disksleep            10
 sleep                10
 autopoweroffdelay    28800
 hibernatemode        25
 autopoweroff         0
 ttyskeepawake        1
 displaysleep         1
 acwake               0
 lidwake              1

Here is when things go wrong on my machine. I close the lid. After 1 minute, I open the lid, it prompts me for filevault key. IF I DO NOT ENTER IT AND CLOSE THE LID AGAIN, THE COMPUTER SHUTSDOWN WHEN I OPEN THE LID ONE MINUTE LATER.

In my pmset -g log, I see the following:

Time stamp                Domain              	Message                                                                    	Duration  	Delay     
==========                ======              	=======                                                                    	========  	=====     
UUID: (null)
2017-04-17 13:51:09 -0400 Start               	powerd process is started                                                  	          
2017-04-17 13:51:09 -0400 Assertions          	Summary- [System: No Assertions] Using Batt(Charge: 73)          
2017-04-17 13:51:09 -0400 HibernateStats      	hibmode=0 standbydelay=0                                                   	          0         	
Sleep/Wakes since boot at 2017-04-17 13:51:09 -0400 :0   Dark Wake Count in this sleep cycle:1

Time stamp                Domain              	Message                                                                    	Duration  	Delay     
==========                ======              	=======                                                                    	========  	=====     
UUID: Unknown UUID
2017-04-17 13:51:09 -0400 Failure             	Sleep Failure [code:0xFFFFFFFF0400001F]:                                   	          

I also see a sleep failure here.

I think apple’s pmset is pretty broken and poorly documented. I don’t know I should even trust the computer to destroy the filevault key properly during sleep and we have little control over when the computer actually enters the standbymode and destroy the filevault key.