I'm looking to give my friend my macbook pro for a month. So how do I make it so there is no possible way that he can access my stuff. When I mean no possible way, I mean no way through terminal or any means like that. Will creating a standard new account satisfy, or something more is required?

  • 1
    Standard user account would do it. It has no access to your account. If you want to be more stringent then create a Guest user with parental restrictions. – Ruskes Jun 29 '15 at 17:46
  • So there is no possible way for a standard user to access an administrator account, even through downloadable programs or terminal. – mike Jun 29 '15 at 17:50
  • That depends on the skillzzz :) normally installing programs require admin rights. Terminal commands accessing system resources also require admin rights (password). Just make sure first take note (on paper) and make new complicated password that can not be guessed (has nothing to do with you. – Ruskes Jun 29 '15 at 17:57

The only way to avoid a user being able to access your data is to remove your data from the machine. This is due to the fact that a user could enable the root user via Single User mode on boot and can then have unfettered access to the system. You can put up blocks to hinder this as well, but that depends on your desire to keep all information secure.

A standard user account is the easiest option and is somewhat effective. However, your friend will not be able to do certain things on the machine since they won't have admin rights. The level of access necessary would hinge on how much the friend would need to do while they have the machine.

  • 1
    To expand on this, a simple method of accomplishing the suggestion would be to create a TimeMachine backup on an external HDD (System Preferences > Time Machine > click "Select Backup Disk") and deleting the user account after backup. Or a clean install of OS X, followed by restoring your TimeMachine backup when you get the laptop back next month. – Rampant Jun 29 '15 at 19:04

You can come pretty close, but not absolutely lock the computer down. There are three critical steps to this:

  • Put all of the files you want to keep private in private directories, e.g. in your Documents folder. The top level of your home folder is readable by all users, and the default permissions for newly created files and folders is similarly readable. Note that this includes things like unix-style configuration files (including invisible "dotfiles") created at the top level of your home folder.

    If you want to, you can remove permissions for other users to read your home folder at all with the command chmod go= ~ -- but note that this will lock other users out of your Public folder as well.

    Also, make sure you don't have any private files stored outside your home folder.

  • Give your friend a "Standard" (or Managed with Parental Controls) account, and make sure they don't know the password(s) to your Administrator account(s).

  • Set a firmware password on the computer. This will prevent your friend from invoking single-user mode (which @smoooosher mentioned), recovery mode, and a number of other startup-time modes that'd let your friend take full control of the computer.

    Don't tell your friend the firmware password.

    Do make sure you remember (i.e. record) the firmware password, so you can remove it later. Resetting a lost firmware password is a major operation on modern Macs, and you don't want to have to go through it.

With these steps, your MacBook Pro will be pretty well locked down, but not absolutely so. There are a couple of possible ways your friend could still bypass security:

  • They could open the MBP up, remove the drive, and read it directly on another computer. Note that enabling FileVault encryption won't really help with this, since any account password (including your friend's) could be used to unlock and read the disk.

  • They could hope for a privilege escalation vulnerability to be discovered in OS X that'd let them get admin or root access from their standard account. You can mitigate this a bit by enabling as much update automation as possible (in System Preferences -> App Store pane).

p.s. You might also want to enable Find My Mac linked to your iCloud account -- this'll let you track and (if necessary) remote-wipe your Mac. Be sure you have a good backup before enabling this, though. Actually, be sure you have a good backup anyway.

p.p.s. From the Ten Immutable Laws Of Security (Version 2.0): "Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore."

  • +1 TIL "Note that enabling FileVault encryption won't really help with this, since any account password (including your friend's) could be used to unlock and read the disk." – Steve Moser Jun 30 '15 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .