6

I've been given a new MacBook Pro at work, and it has an administrator account which I assume the IT department has the credentials to. I have been created a local account which is also an administrator.

I'm just wondering, as another administrator, what of my data can they access and read? I have iCloud Drive and other services turned on, and I don't particularly like the idea that someone can go in and grab that stuff.

8

Short answer: Generally an administrator account can access and read any file on the computer. To protect files, either remove all untrusted admin accounts except for yours or encrypt the specific files you need protected with your admin password. Another admin can reset your password, but not see it to unlock things like your keychain. Of course a new password for encryption is ideal if you don’t trust another admin.

There are certain files within your account that are encrypted and can not be read without your password.

The main file I'm thinking of is the "Keychain" which may contain your iCloud password and any other passwords you've allowed Safari (or other apps) to remember.


As an IT system administrator myself I would recommend not to store personal data on your work computer that you don't want anyone else to see.

The computer may have backup software that's backing up all files on the computer - including your iCloud Drive.

Also remember that if you're fired, the computer may be taken away before you have a chance to remove your personal files.

  • 4
    Even in jurisdictions that are typically very worker- and privacy-friendly, it is generally accepted that all files you store on a company device "belong to" the company, at least in the sense that they can arbitrarily delete them. While in the more privacy-conscious jurisdictions, it may be illegal for an IT admin to continue reading when he accidentally discovers private files on your device, there is a) no guarantee that he will actually do that, and b) he is allowed anyway to read anything on your device until he discovers obviously private data. – Jörg W Mittag Apr 10 at 7:08
  • 1
    Plus, not all jurisdictions are that privacy-conscious. – Jörg W Mittag Apr 10 at 7:09
  • 1
    This answer doesn't address FileVault (nor encrypted backups). Can encrypted files inside FileVault be read by other admins? I thought the answer was no. – Konrad Rudolph Apr 10 at 8:21
  • 1
    @KonradRudolph The original version of FileVault (which encrypted individual home directories) could not be read be others unless a specific user was logged in. The current version with full disk encryption does not provide that level of privacy, any user allowed to unlock will unlock the whole disk. – nohillside Apr 10 at 21:55
6

This document provided by Apple titled: Set up users, guests and groups on Mac covers the types of privileges each user type is allowed.

Administrator: An administrator can add and manage other users, install apps and change settings. The new user you create when you first set up your Mac is an administrator. Your Mac can have multiple administrators. You can create new ones, and convert standard users to administrators. Don’t set up automatic login for an administrator. If you do, someone could simply restart your Mac and gain access with administrator privileges. To keep your Mac secure, don’t share administrator names and passwords.

Expanding on this, basically an Administrator can access any of your files and pretty much do anything on the system.

References

2

An Administrator account should be able to install software to log keystrokes, a keylogger. With your keyboard input captured, any passwords input would be captured and could be used to open otherwise secure applications and files. I cannot say whether Apple prevents their use on macOS, but anyone sufficiently determined would be able to circumvent such restrictions.

Also, screen capture software can often be used to determine what keystrokes have been made, especially on mobile devices where the on-screen keyboard keys pop-up as typed.

It is not your computer. Treat it as such.

  • There are dialogs that use "secure input," which I believe prevent other apps from reading/writing what's being input. I use a text replacement app and, for example, when entering a password on Safari I can't use the text replacement app. – Harv Apr 17 at 5:13
  • I would point out that these special "secure input" dialogues are completely indistinguishable from any other dialogue on macOS nor can they be identified as to the program it is associated (unlike on Windows which at least flashes initially). This is a major complaint of mine with macOS. – newyork10023 May 3 at 20:21
  • True. Check out the products over at objective-see.com, you may be interested in them. They're free, and centred around security. – Harv May 4 at 1:13
  • Indeed, I checked out the new ReiKey, which specifically would be relevant to this discussion. It is only supported on macOS 10.13+, which I won't run until APFS is widely supported by utility vendors (one in particular which I won't mention to avoid needless downvotes). I run many of the utilities there, at least when possible (some are 10.11 only, etc.). – newyork10023 May 5 at 2:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .