up vote 0 down vote favorite
share [g+] share [fb]

I have a Mac and I'm the only user of it. I have admin privileges and I just want to know what some of the things that could go wrong are.

So here are my questions:

  1. What can go wrong if I use an account with admin privileges all the time?

  2. Should I create another account just for the admin and then downgrade my current account and only use it?

link|improve this question
2  
Malware makers have finally waken up to the fact that Macs are popular enough to be valid targets. Don't make their job easier. – Mark Ransom Jan 18 at 21:44
@MarkRansom Could you point me to any evidence of that (both actual malware, and how having an Administrator account on OS X enables them? And I don't mean fake DivX installers where you need to enter your admin password to "install". A nine year old can do that. – Daniel Beck Jan 18 at 23:01
@DanielBeck, sorry I don't have any direct evidence, I'm not a Mac user. I do know that recent contests to take over a machine have been won by someone attacking OS X. And surely there wouldn't be admin privileges if they weren't protecting something important, would there? – Mark Ransom Jan 18 at 23:11
@MarkRansom There are (or were) remote exploits, e.g. weaknesses in Webkit and/or the image libraries, but they just get you onto the system with the current user's privileges, which, by default, aren't endangering the system. Regarding admin/user accounts, see my answer. It's largely the difference between entering your own password, or another user's, when prompted. If you're the only person using the machine, it doesn't make a difference. – Daniel Beck Jan 18 at 23:22
feedback

2 Answers

up vote 1 down vote accepted

Your user account does not have permanently "active" administration privileges.

All actions that require elevated privileges require you to enter your password. If you weren't an administrator, you'd need to enter an administrator's user name and password instead.

These actions include:

  • Modifying or setting permissions on files and folders you don't own or have sufficient permissions to
  • Installing applications that require root privileges somewhere along the line (e.g. for driver installation)
  • Changing any of the system preferences
  • Executing command-line utilities with elevated privileges

Without entering your own account's password, you can do nothing that requires elevated privileges.

What appears to be "automatic privileges", such as the ability to write to /Applications, is realized using group memberships. Your admin account is a member of the wheel and admin groups, and /Applications is group-writeable for members of the admin group. Very few locations in the system have privileges like these. Here, it's simply a convenience feature.

The difference between having one admin account, or a primary, regular account and a secondary admin account are basically the permissions you lose by missing out on some group memberships, and slightly more hassle with granting administrator privileges both in the GUI and on the command-line (sudo doesn't work anymore, as you're not a member of wheel).

link|improve this answer
Ok this makes sense. I think I will just keep my one and only account as it can't really do any harm unless I do something really stupid. – Jacob Jan 18 at 22:36
@Jake It's possible to engineer a problem, e.g. planting an application in /Applications without you noticing, and then expect you to grant it admin privileges when you start it to see what it is. Other than that, there's little difference. – Daniel Beck Jan 18 at 22:44
@DavidBeck: But he asked about advantage and disadvantage. My answer covers his complex question and it's include speed and password, too. I don't try to just make it looks like a technical thing!!!! – David Jan 18 at 22:44
@)ake: I don't deserve you change your opinion. This answer is fud. – David Jan 18 at 22:45
@DanielBeck: Mine isn't wrong because I don't use Mac but Linux and if you can read I wrote ROOT folder. It seems like you Mac doesn't have it although it's a Unix/Linux thing. So what do you recommend now what he should do? – David Jan 18 at 22:53
show 2 more comments
feedback
up vote 0 down vote

If you are the only user then there isn't an advantage to use the admin user all the time over not using the admin user at all. However it's not very recommended to use it because programs you install will install into the root folder and programs you run will have elevated privilege but your system won't become slower and the program you start with the gui wouldn't have admin privilege. If you have 2 accounts then you need to memorize 2 passwords. This can be hard to memorize, as such I don't think you need another account but you can make the user account without a password and use the admin account only when it's necessary.

link|improve this answer
Most installers require you to enter the password anyway, and as administrator you can install regular applications (app bundles) to ~/Applications without problems. – Daniel Beck Jan 18 at 22:08
@DanielBeck: When I mean install then all configurations file is in root folder. – David Jan 18 at 22:11
@David I don't see much harm in continuing with using the admin account. – Jacob Jan 18 at 22:13
@David That's just plain wrong. All your programs' preferences are stored in your user profile, unless the program specifically needs to write them globally, and then you either need to give it elevated permissions every time it runs, or approve it to set setuid or setgid permissions. This approval is basically the same for both Administrator and User accounts. – Daniel Beck Jan 18 at 22:19
1  
Programs are (with very few exceptions) executed with the privileges of the user you started them. They don't automatically have elevated privileges, neither through the user who installed them, nor the user who launched them. – Daniel Beck Jan 18 at 22:53
show 9 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.