4 ms·
That's an odd position to take. I purposefully make my primary account a non-administrator and elevate permissions with my administrator account when I need to
by deftnerd 7y ago
That's an odd position to take. I purposefully make my primary account a non-administrator and elevate permissions with my administrator account when I need to perform administrative tasks. This prevents scripts or programs from misusing permissions without my knowledge.
It's also the default policy of my work, a university. Staff do have local administrator access to their machines, but are not supposed to use it for regular operations for safety.
- snowwrestler 7y agoMe too, and when I need to install non-Apple-approved software, I log into my admin account, do it, then log out of it again. Once the software is installed, I can use it from my regular account. > Staff do have local administrator access to their machines, but are not supposed to use it for regular operations for safety. The point of this exercise is that installing random software from the Internet shouldn't be a regular operation; users should take extra care when doing it.
- dkonofalski 7y agoJust out of curiosity, why don't you just put in your admin credentials when the prompt displays? Logging completely out of the current account and logging in to another account just to install software seems way more convoluted than necessary.
- snowwrestler 7y agoThat's what I do if it's an option, but I think I've run into some software where that didn't work and I had to actually log into my admin account to install it. (But not log out of my regular one; more than one account can be logged in at once.) I can't recall what software that was, though.
- filleduchaos 7y ago> I purposefully make my primary account a non-administrator and elevate permissions with my administrator account when I need to perform administrative tasks So...elevate permissions when you need to perform this new administrative task? I don't see how that changes the crux of the matter (you still are the de facto admin, even though you've applied artificial constraints to yourself, because you hold the admin credentials).
- saagarjha 7y agoArbitrary programs cannot use de facto credentials.
- filleduchaos 7y ago...yes, they can? You're prompted to provide credentials (in some cases biometrics is fine, in others you must enter the password) if you/an application is trying to do something that requires escalated privileges. Do you use macOS?
- saagarjha 7y agoRight, but now you have explicit consent required to elevate to that level, whereas if you’re running as root already you can just silently do things without the user knowing. > Do you use macOS? Almost exclusively.
- throw0101a 7y agoThis is fairly standard best practice: your day-to-day account should not have admin-level privileges. It's the rough equivalent of running as root all the time (hand-waving a bit here).
- simonh 7y agoAdmin accounts on MacOS have to provide the admin password again (essentially sudo) to make any significant change to the system config. That includes installing applications, changing security, privacy and accessibility changes, etc.