Quantcast
Channel: What point is there in using an everyday non-admin account on OS X? - Ask Different
Viewing all articles
Browse latest Browse all 8

What point is there in using an everyday non-admin account on OS X?

$
0
0

This piece of advice is old but is coming back into fashion. I have seen it a lot recently, on a number of Mac websites or forums. "Your ‘everyday’ user account should not be an admin account. It should be a standard account created for this purpose, and you should log to the admin account only to perform actual admin tasks. »

This seems to be common advice in the Windows world, but for an up-to-date OS X system, I just cannot understand what kind of benefits it brings. Let’s dig into it:

  • OS X admin accounts are not root accounts. Any app wanting to go root will ask for your password anyway, so I see no additional security layer here. Try to put /var into the Trash.
  • Deep OS modification or code injection into most critical files has been prevented by SIP from El Capitan, whether your are admin, root or nobody. What’s more, in sensitive places where they are still allowed, such modifications would require a root password at the very least, even from an admin account, bringing us back to the first argument.
  • For spyware, privacy concerns and this kind of stuff, using standard accounts provides little additional protection, if any. As far as I know, even when used from a standard account, apps have full access to the user’s personal files and have full network access (minus any firewall, etc.). If a bad app wants to send home your docs, it can perfectly do so from a standard account.
  • Basic lines of defense (firewall, running trusted apps, and so on) are system wide.
  • On the other hand, it is a pain to switch to your admin account, then switch back to your standard account, back and forth. This may actually end up with the user delaying updates or admin maintenance, just to save time and postpone dealing with the hassle.

So, why not use an admin account? I hope this won’t be marked as duplicate, other questions related to this issue didn't address these arguments.

Edit: the question applies to a computer that you own and control.


Viewing all articles
Browse latest Browse all 8

Latest Images

Trending Articles



Latest Images