Encrypted drives accessible by other users

Question

Howdy,
I am looking into encryption methods for OS X (previous post here: https://discussions.apple.com/message/22321009#22321009) and in playing around with it i found the following:
If i have an encrypted drive or partition mounted on my desktop i can not secure it by simply unmounting, logging out or starting a password protected screensaver. Another user can sign in through 1. fast user switching, 2. the main login window after i have logged out and 3. by using the 'Switch User' button at the bottom of the screensaver when it asks for a password. As soon as the other user logs in, there are my encrypted drives or partitions, no password asked!
The only way to secure an encrypted drive is to 1. Restart the Mac, 2. Turn off the Mac or 3. in the case of an external device, physically disconnect it.
Am i overreacting or is this a huge security concern/flaw and more importantly, are there ways to plug these holes if multiple users have to have an account on the same system?
I have read something similar a few months ago that mentioned simply unmounting a drive was not secure but it did not cover other users or offer a solution (can't find the article anymore).
Jay

Answer 1

This is how mounting volumes works in OS X. Once mounted, a drive is available systemwide, and not restricted to a specific user. The encryption that OS X sets up on a drive is per-volume only, and not intended to protect the data from other users on the system. Instead, its intent is to prevent someone from finding your drive and plugging it into another system to overcome security and access your files.
Ultimately the mode for securing files from other users of the same system is to not rely on encrypted volumes. If mounted, the unencrypted drive will remain unlocked and re-mountable. The only way to secure it again is to fully detach or eject it from the system.
However, overall it is not really a security flaw in the system. While intuitively it may seem the system ought to lock the drive again once ejected, this behavior still falls in line with how the system already handles local drives, where any volume (encrypted or not) is viewable accessible by other user accounts.
The way you can prevent another user from accessing the mounted volume is to get information on the volume, and then click the lock at the bottom to authenticate for changes, and then uncheck the box to ignore ownership on the volume. This will have the system observe permissions restrictions for files on the drive, but keep in mind this will only be restrictive to non-administrative accounts, as any admin can re-check the box and have full access to the drive again.
An alternative option is to use an encrypted disk image to secure files. Unlike encrypted drives, the system should fully eject an encrypted disk image when you eject it, requiring its password to be entered when mounting the image again. Unfortunately as with other mounted volumes, if you mount the disk image in your account and keep it mounted, then another user that logs in at the same time will be able to access this volume.