Using EFI password "full" security isn't working

Question

Hi,
I'm trying to use the EFI Password Utility to prohibit any attempt to boot my MacBook Pro without the correct password.  I used the utility available on the MacBook Pro's supplied install DVD, and so far have successfully prevented the use of any keystrokes on boot without the correct password (ie. "command" mode).  However, I am unable to set the EFI to prohibit any attempt to boot.
Apple documents in its, "Mac OS X: Security Configuration - For Mac OS X Version 10.6 Snow Leopard" PDF manual that,
You can also configure EFI from the command line by using the nvram tool. […] 
You can set the security mode to one of the following values:
     Full: This value requires a password to start up or restart your computer. It also requires a password to make changes to EFI.
For example, to set the security-mode to full you would use the following command:
     $ sudo nvram security-mode=full
I applied this setting, but it doesn't appear to be working.  The redacted output of "nvram -x -p" is as follows:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
          <key>EFICapsule_Result</key>
          <data>
          REDACTED
          </data>
          <key>SmcFlasherResult</key>
          <data>
          REDACTED
          </data>
          <key>SystemAudioVolume</key>
          <data>
          REDACTED
          </data>
          <key>boot-image</key>
          <data>
          REDACTED
          </data>
          <key>efi-apple-payload0</key>
          <data>
          REDACTED
          </data>
          <key>efi-apple-payload0-data</key>
          <data>
          REDACTED
          </data>
          <key>efi-apple-recovery</key>
          <data>
          REDACTED
          </data>
          <key>efi-boot-device</key>
          <data>
          REDACTED
          </data>
          <key>efi-boot-device-data</key>
          <data>
          REDACTED
          </data>
          <key>gpu-policy</key>
          <data>
          REDACTED
          </data>
          <key>prev-lang:kbd</key>
          <data>
          REDACTED
          </data>
          <key>security-mode</key>
          <string>full</string>
</dict>
</plist>
What makes it confusing is that Apple specifies later on the same page (56) that the the term passed to the "security-mode" option should be encased in quotes:
# Secure startup by setting security-mode. Replace $mode-value with # "command" or "full."
     sudo nvram security-mode="$mode-value"
So, assuming that I may have used the wrong version of the command, and thereby not applied the setting correctly, I deleted the "security-mode" key using:
sudo nvram -d security-mode
I then re-applied the setting using:
sudo nvram security-mode=full
because I was confident that, initially, I had used the version with quotes.  However, it's made no difference - booting the machine does not require entry of an EFI password.
Oddly, the EFI still prevents the use of keystrokes (ie. "command" mode), so it's definitely functional; I just can't tell it to use "full" mode.  Also, I note that "security-mode" is the only key to have a "string" child not a "data" child - is this indicative of a problem?
Any advice?

Answer 1

I've got the same problem as OP but I'm not concerning myself with the physical security of my device--an entirely separate topic altogether.
Essentially, I know that with physical access to a Mac box it's possible to enter single user mode and change the password. I also know there is a way to prevent that ability by changing the default login credentials I just don't remember the phrase of what I'm looking for. I know that I have a pdf on hardening snow leopard which probably has information on how to restrict password changes when in single user mode, but I can't find it.
Here's some stuff that should at least get you started in the right direction:
http://support.apple.com/kb/HT1352
http://lists.apple.com/archives/fed-talk/2011/Feb/msg00022.html
Definitely read:
http://www.nsa.gov/ia/_files/factsheets/macosx_10_6_hardeningtips.pdf
Depending how much time you want to spend on this, there's also a book by Charlie Miller called "Mac Hackers Handbook" that's worth the read--although I have yet to do completely so myself. I did get to see his talk at DefCon 2011 and it was pretty amazing- he developed a technique to essentially make a Mac laptop battery explode from a remote location-- although he never has actually done it for fear of...you know...actually destroying his computer. lol. The next time you hear a MacTard bragging about how OSX is a secure platform, be sure to bring that up. Also distinguish between viruses and malware in general the next time you talk to a genius about mac security- we recently discovered a rootkit on one of the Macs on our network.
Back to the topic--If you're going to go through the effort of securing one aspect of your box, you mind as well keep going with it if you have legitimate reasons to worry about unauthorized access.
Another awesome resource is the Electronic Frontier Foundation:
https://www.eff.org
https://ssd.eff.org/risk
They have guides about nearly everything concerning online anonymity and/or security and they're really good about keeping it 'human readable' - ie understandable to the average user. I'll try to find that pdf and upload it if I do. Those other resources should point you in the right direction- if not explicitly answer your question. Let me know if you find anything too . Help me help you.
<Edited by Host>