Privilege seperation when using the same login credentials?

Question

While thinking about preventing ransomware attacks on my machine I stumbled across the following question:

Assume I'm on a Windows (10) PC.
Assume further that I have two (local) accounts, one with admin privileges and one without where the second is the one I use day-to-day.

Now assume that both accounts use the same login credentials.

Is this as secure (against malware and such) as using different credentials?

If needed (I prefer a general answer) it may be assumed that the shared credential is a smart card (using different certificates for both accounts).

Please note: The threat model only includes things that can happen while the (standard) user is logged on. I totally understand that if somebody can get hands on the credentials he'll be able to just log-in as admin.

Answer 1

If I understand your question, your credentials are not strictly speaking the same. Normally your credentials consist of the identity name (account name) as well as the authentication credentials. It sounds to me that you have two different sets of credentials, but which happen to have the same authentication credentials?

If that is the case and given the limited scope you outline, I would suggest there is no significant risk and would argue it is certainly a big improvement over just adding admin rights to your normal operating account (which seems to be the most common user 'convenient') solution.

It would not be an approach I would normally recommend as I think there are other issues (ruled out in your scope statement). If you think about it, on any large server it is quite likely you will have two accounts which have the same password, but this doesn't reduce the security of either account.

The main danger I would see here is with being logged into the account with admin privileges by accident or without realising it - different authentication tokens is often a convenient safety net to ensure you are logged into the account you meant to - finger memory and automated processes when in a hurry can have interesting side effects - probably not an issue if your authentication is managed by smart card, in which case, this is probably a nice compromise compared to having to carry two smart cards!