Which FileVault 2 recovery option is more secure - storing the recovery key in iCloud, or saving it somewhere yourself? When setting up FileVault 2 on a computer, you're presented with 2 recovery options - storing the recovery key with your iCloud account / Apple ID, and displaying the recovery key (for you to write down / save somewhere yourself). However, after doing some research, I found some posts that claim to be able to extract FileVault recovery keys from users' iCloud accounts, which makes me wonder if storing the recovery key with iCloud is the best solution. For a point of reference, I also looked at Apple's whitepaper on FileVault, which explains that the recovery key is protected by a "wrapping" key generated by hashing the responses to 3 security questions. Still, if this exploit's legit, as far as I can tell this would only matter if someone had physical access to your computer.

Given these two recovery options, which would be more secure?


Store recovery key with iCloud
Store recovery key in a password manager, where it's synced to multiple devices via a service like Dropbox


I'm currently thinking option 2 would be, because there's the extra layer of the password manager vault even if the file syncing service were compromised, but that might be equivalent to the wrapping key hashing Apple adds.
Saving it somewhere yourself is more secure as long as that somewhere else is memorized in your own brain. Otherwise the answer to this isn't static.

iCloud can have vulnerabilities and so can Dropbox. Knowing about some vulnerabilities only informs you about those that have become public. Right now we might possibly know about a vulnerability in iCloud, but tomorrow that could be patched and 12 vulnerabilities in Dropbox could be revealed. 

I would consider them to be basically equal if you aren't going to memorize the recovery key.

As an aside, I don't memorize my own keys, I keep them in Dropbox using 1Password