{"action":"created","issue":{"url":"https://api.github.com/repos/drduh/macOS-Security-and-Privacy-Guide/issues/167","repository_url":"https://api.github.com/repos/drduh/macOS-Security-and-Privacy-Guide","labels_url":"https://api.github.com/repos/drduh/macOS-Security-and-Privacy-Guide/issues/167/labels{/name}","comments_url":"https://api.github.com/repos/drduh/macOS-Security-and-Privacy-Guide/issues/167/comments","events_url":"https://api.github.com/repos/drduh/macOS-Security-and-Privacy-Guide/issues/167/events","html_url":"https://github.com/drduh/macOS-Security-and-Privacy-Guide/issues/167","id":191351429,"number":167,"title":"Is having a separate admin and normal account actually helpful?","user":{"login":"willangley","id":999089,"avatar_url":"https://avatars.githubusercontent.com/u/999089?v=3","gravatar_id":"","url":"https://api.github.com/users/willangley","html_url":"https://github.com/willangley","followers_url":"https://api.github.com/users/willangley/followers","following_url":"https://api.github.com/users/willangley/following{/other_user}","gists_url":"https://api.github.com/users/willangley/gists{/gist_id}","starred_url":"https://api.github.com/users/willangley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/willangley/subscriptions","organizations_url":"https://api.github.com/users/willangley/orgs","repos_url":"https://api.github.com/users/willangley/repos","events_url":"https://api.github.com/users/willangley/events{/privacy}","received_events_url":"https://api.github.com/users/willangley/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-23T18:41:02Z","updated_at":"2016-11-23T21:42:37Z","closed_at":null,"body":"[based on a conversation we had in person some months ago, and then promptly forgot about]\r\n\r\nHaving separate admin and normal accounts is good advice on Windows, but Microsoft has invested a great deal of effort in this part of Windows and the Windows ecosystem has followed suit.\r\n\r\nI've seen little evidence that making normal accounts work as a security boundary has the same priority for Apple or for Mac software vendors, and enough breakage that I suspect that they're mostly designed and tested to make it harder for kids to mess up a family computer:\r\n\r\n* When I used a Mac that was configured with separate admin and normal accounts (through El Capitan in late 2015) many of my installed-from-the-Internet apps would not update properly. The level of frustration was pretty much steady between late 2009, when I started running with reduced privileges, and late 2015, when I retired that Mac. I would be surprised if this has gotten better.\r\n\r\n    My instinct is that apps largely work fine if you have an admin user logging in regularly, less so in the case where the admin user never logs in interactively like this guide suggests.\r\n* macOS has privilege escalation vulnerabilities [discovered regularly](https://googleprojectzero.blogspot.com/2016/10/taskt-considered-harmful.html) and historically receives fixes for them [more slowly than iOS does](https://googleprojectzero.blogspot.com/2014/10/more-mac-os-x-and-iphone-sandbox.html).\r\n* The local intrusion prevention software in this guide, like BlockBlock, seem to mostly target actions that could only be performed by an attacker already running code as an admin user.\r\n* I don't see anything else in this guide that will detect local privilege escalation that is *not* immediately exploited, either from a known or an unknown source. (The audit logs might, but I don't feel like I've learned how to see such an attack from reading this guide.)\r\n\r\nDoes anyone have thoughts? / data on the effectiveness of this advice on the Mac? / ideas on how to catch privilege escalations when the system doesn't?"},"comment":{"url":"https://api.github.com/repos/drduh/macOS-Security-and-Privacy-Guide/issues/comments/262637008","html_url":"https://github.com/drduh/macOS-Security-and-Privacy-Guide/issues/167#issuecomment-262637008","issue_url":"https://api.github.com/repos/drduh/macOS-Security-and-Privacy-Guide/issues/167","id":262637008,"user":{"login":"9Yg1rxeSeha90ZU1","id":355620,"avatar_url":"https://avatars.githubusercontent.com/u/355620?v=3","gravatar_id":"","url":"https://api.github.com/users/9Yg1rxeSeha90ZU1","html_url":"https://github.com/9Yg1rxeSeha90ZU1","followers_url":"https://api.github.com/users/9Yg1rxeSeha90ZU1/followers","following_url":"https://api.github.com/users/9Yg1rxeSeha90ZU1/following{/other_user}","gists_url":"https://api.github.com/users/9Yg1rxeSeha90ZU1/gists{/gist_id}","starred_url":"https://api.github.com/users/9Yg1rxeSeha90ZU1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/9Yg1rxeSeha90ZU1/subscriptions","organizations_url":"https://api.github.com/users/9Yg1rxeSeha90ZU1/orgs","repos_url":"https://api.github.com/users/9Yg1rxeSeha90ZU1/repos","events_url":"https://api.github.com/users/9Yg1rxeSeha90ZU1/events{/privacy}","received_events_url":"https://api.github.com/users/9Yg1rxeSeha90ZU1/received_events","type":"User","site_admin":false},"created_at":"2016-11-23T21:42:37Z","updated_at":"2016-11-23T21:42:37Z","body":"Separate admin and user accounts are preferable. You can also set up brew under the admin account, so it  cannot be directly run without being logged in as the other admin. Then you can also lock down the standard user account ever further. Or, you could even set up a completely separate user for brew alone and only allow brew tasks. Privilege segmentation is preferable, but it may impact usability for noobs."}}
{"actor":{"display_login":"9Yg1rxeSeha90ZU1"}}