1

I am new in Mac world. I am the only user of my Mac with OS X 10.9.3 but sometimes other people use my computer.

My purpose is to prevent installation of malware, spyware and surveillance software.

Is OS X secure about this, if not, how can I make it secure?

Can I let my Mac ask administrator password whenever a user including admin and Guest accounts install applications?

  • 1
    Unless you enable filevault, there is no way to prevent others with direct access to the machine from installing whatever they wish--system wide--onto the machine. Why? Because anyone can reset your administrative password using recovery mode. This feature is not available using filevault. Note: you will obviously be aware your admin. password has been reset, though doing so is extremely simple, as shown above, under normal circumstances. – njboot Jun 30 '14 at 4:14
  • Thank you for the comment. This is important information. Luckily I already enabled Filevault. – Ted Jun 30 '14 at 8:52
1

To expand on @Martin's suggestion of using a non-admin account for day-to-day operations: you can convert your existing account to a non-admin, and save the trouble of switching to a new account:

  1. Create a new administrator account (in System Preferences -> Users & Groups)
  2. Log out of your regular account, then log in as the new admin
  3. Open System Preferences -> Users & Groups, and remove the admin rights for your regular account
  4. Restart the computer, then log in with your regular (no longer admin) account

Note that even though you aren't logged in as an admin, you can still perform administrative tasks; you'll just have to provide the admin account's name & password each time (e.g. by clicking the padlock icon in System Preferences).

You can tighten things a little more by putting some additional restrictions on software installation by tightening the Gatekeeper policy. Open System Preferences -> Security & Privacy -> General tab, click the padlock and authenticate as the admin, then change the "Allow apps downloaded from:" policy to "Mac App Store". Note that you will still be able to install other apps, but it'll require a special override (see "How to open an app from a unidentified developer and exempt it from Gatekeeper" in Apple's support article on Gatekeeper) -- which will require the admin name & password.

If you want to be really restrictive, you can even limit installations from the Mac App Store by enabling parental controls on your account (you'll have to actually log into the admin to do this), and setting limits on what apps can be purchased, installed, and run. But I'd consider this overkill, since everything in the App Store has been vetted by Apple; it's not an absolute guarantee it's not malicious, but I'd consider it pretty safe.

| improve this answer | |
  • Thank you for your helpful answer. I choose this as solution. Upon your answer my next question is: Are developers allowed to put their apps on to Mac App Store in case such apps are designed for spying (logging keyboard activity, taking screenshots etc)? Are "identified developers" allowed to do this? – Ted Jun 30 '14 at 9:04
  • Logging keyboard events: no. Taking screenshots: yes, as far as I know. "Identified developers" can do "everything", but if Apple gets a hint about spying then they can ban this developer. – Martin Jun 30 '14 at 11:35
  • I think you are very much interested in a "secure Mac". I searched stackexchange and did not find a thread "how to make a Mac as secure as possible". If you ask that question, I (and may be others) would like to give you detailed informations... just an idea... – Martin Jun 30 '14 at 19:41
  • I would be very interested in that question, yes, but I am afraid such a question would be too general. From safe computing habits to firewalls, everything would be in the scope of security. – Ted Jul 1 '14 at 11:55
4

If other people use only the guest account, then they have no privileges to install anything.

I have added another account (beside the admin and guest account) which I use for daily work. The reason: sometimes someone ask me if he can use my computer for a short moment, and this way I do not have to switch to the guest account.

And because this third account has no admin privileges, it is more secure than using an admin account for daily work.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .