First some important commands to know:
ls -laO
shows a lot:
drwxrwxr-x+ 19 myuser1 staff 714 2 Feb 10:31 My Passport
ls -elaO
includes ACLs:
drwxrwxr-x+ 19 myuser1 staff 714 2 Feb 10:31 My Passport
0: user:_spotlight inherited allow list,search,file_inherit,directory_inherit
The following command shows all members of a group (the example group here is staff):
members () { dscl . -list /Users | while read user; do printf "$user "; dsmemberutil checkmembership -U "$user" -G "$*"; done | grep "is a member" | cut -d " " -f 1; }; members staff
The following command shows the UID, the GID and the group memberships of user_name
id user_name
Please check your various users/groups with the last two commands to get an overview.
Standard permissions in the file system are applied by using UID and GID instead of names. So
drwxrwxr-x+ 19 myuser1 staff 714 2 Feb 10:31 My Passport
should be read as (assuming myuser1's UID=501):
drwxrwxr-x+ 19 UID=501 GID=20 714 2 Feb 10:31 My Passport
| | |
| | |Others (Members of GID=12 (Everyone)?) can read and execute
| |Members of GID=20 can read, write and execute
|UID=501 can read, write and execute (owner)
Attaching My Passport to another Mac (Mac2) - the UID/GID won't be changed - will reveal the following:
In case myuser2's UID=501 and GID=20 (GID=20 (staff) is a standard group on every Mac and every (standard or admin) user created with the System Preferences is member of it)
drwxrwxr-x+ 19 UID=501 GID=20 714 2 Feb 10:31 My Passport
which retranslates to:
drwxrwxr-x+ 19 myuser2 staff 714 2 Feb 10:31 My Passport
and myuser2 on Mac2 has the same rights as myuser1 on Mac1
In case myuser2's UID=502 and myuser3's UID=501 and both are member of staff:
drwxrwxr-x+ 19 myuser3 staff 714 2 Feb 10:31 My Passport
myuser2 as member of staff isn't owner anymore but can still rwx.
In case myuser2's UID=502 and is member of staff and myuser3 with UID=501 has been deleted:
drwxrwxr-x+ 19 (unknown user) staff 714 2 Feb 10:31 My Passport
myuser2 as member of staff isn't owner anymore but can still rwx.
In case myuser2's UID=503 and is not member of staff and UID=501 is deleted
drwxrwxr-x+ 19 (unknown user) staff 714 2 Feb 10:31 My Passport
myuser2 as others (member of everyone?) can rx.
So to answer your questions: the reason why myuser2 on Mac2 has the same rights as myuser1 on Mac1 are the same UID and GID/group memberships of both on their respective host. Staff is a default group on every Mac.
In your current environment (single machines/admin rights for the main user(s)) using external drives is not "secure/save" - only using permissions to determine access. And it was never meant to be.
In an organizational unit (the common user of a workstation is no admin) with a centralized user management (OD etc.) you may use applied mount points and special groups do deal with external drives:
Special owner and a new group for the drive/mountpoint:
drwxrwx--- 19 UID=501 GID=512 714 2 Feb 10:31 My Passport
or
drwxrwx--- 19 UID=501 GID=512 714 2 Feb 10:31 My Passport/share_folder
and all non-admin users which require access to the external drive(s) are member of GID=512 ("External Drive Users")
Still, when the external drive is lost, anyone may have access to it. To make it secure you have to encrypt the content of the external disks.