0

I just read this article about making a computer safer: Komando.

They recommend using a standard user account for daily use, and using a separate admin account for making changes. I do this at work so that if someone sees my password, they won't be able to make serious changes to my system.

On my Windows 10 laptop at home, I use the admin account for daily use. I never install anything, except the Chrome browser. I literally never install anything because I am paranoid. I don't even have flash and I disabled the browser extensions/plugins. In this situation, how would using a separate standard account make it safer?

To put it another way, if you were attacking a system like my home laptop, would it slow you down at all if they were using a standard account?

marked as duplicate by yzT, S.L. Barth, techraf, Matthew, Rory Alsop Aug 4 '16 at 11:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • to answer the last question: those stupid UAC prompts slow everyone down. – dandavis Aug 3 '16 at 17:15
  • dandavis - 'stupid' is definitely something they aren't. Whether they are useful for non-technical users is debatable, but UAC is very effective, not stupid.. – Rory Alsop Aug 4 '16 at 11:44
1

Yes, it's safer

If you mean safe in the general case ("can they introduce a boot time backdoor or format my hard drive"), then yes, using a standard account is much safer.

With an administrator account, you might not install software, but as soon as some attacker manages to use a Chrome weakness to run some arbitrary software on your PC, you're done for.

It does not matter how safe Chrome is. There have been attack vectors like images libraries - they could get in (and did so, in the past) simply by placing a prepared GIF/PNG on some harmless website. They could exploit some fancy Chrome bug and install some plugin which you notice only when it's too late.

No, it's not safer

If you mean "safe" as in specifically "can they get my data, impersonate me or empty my bank account, make me take part in DDOS attacks" and so on, then no. If you are the only user of the machine anyways, and do everything from your one unprivileged account, then they can pretty much do to you whatever they could if you had admin access. They just can't harm the system itself or other users on that machine (in this scenario, there are none).

It will still make it a little harder (they will have a hard time overriding security prompts by whatever software you are using, and so on), but generally possible.

So...

The benefit of using a standard account is that you do other stuff in other accounts. I.e., if you do general web browsing, you do that on another account than your online banking (depending on your level of paranoia). If you have wife and kids, they use different standard accounts. If you have an antivirus or a local firewall, you configure them from the admin account and not your personal one. And so on.

0

The use of a Standard Account stems from the concept of the principal of least privilege. On home systems, it's goal is to prevent the execution of code without the express permission of the user.

You find this on Unix, Linux and OSX in the form of having to type your password to change settings, add software, etc.

In Windows, you find this is the form of the UAC system. These are the prompts which ask you if you really are sure you want to install software.

Note: Microsoft can be setup to operate like the other systems.

A Standard account prevents an attack from using escalated functionality on they system without you express permission.

To put it another way, it's the difference between an attacker destroying your system but they have the rights to delete you C: drive, and a failure to execute a command because they don't have those rights.

Extreme case, but pointed.

Not the answer you're looking for? Browse other questions tagged or ask your own question.