It’s time again for another family tech support mythbusters episode. This time we’ll tackle the premise that it’s more “secure” to login to your system as a user rather than an administrator.
The idea to limit your logged in privileges on a system is a sound one, provided the system that enforces privileges actually works. Often the reason a system is compromised has little to do with a user being logged in as admin or not, it’s more basic than that: it’s just a simple security hole that skips right on by any sort of privilege enforcement system.
When a virus exploits the security of a machine, it really doesnt matter that said “security” has you running in user mode or admin mode. If its compromised, the system’s compromised.
The argument for not running in admin mode is kind of like this:
You’re in the middle of a jail or fortress, with big concrete walls around it. There’s a big red button to open a massive steel re-inforced front door. Running in admin mode, you have the ability to press that big red button, and running without admin mode (As a user) you arent allowed to press that red button. This sounds good, being a user is obviously safer, because nobody’s coming in through the door b/c you can’t press the button easily.
Except the enemy comes in with an armored tank, through the concrete wall on the side of the building. The red button, and admin/user level login meant nothing because the problem wasnt the red button and your ability to invite the enemy in, the problem was the enemy completely subverted the entire security system in some other way that was unrelated.
Now, obviously, if “you know what you’re doing” (tm family tech support geeks everywhere)”, there are benefits to properly locking down a machine, enterprise I.T. departments do it all the time, and it helps to some degree. The concept’s not completely off-base.
The concept falls down when the “you don’t know what you’re doing” users think this and other security measures will magically protect them on their home computer. The reality is, when your parents or non-tech family members run their computer at home, they’re still going to click on that anti-virus-looking popup, and it’s still going to compromise the system even though they’re not logged in as admin.
Worse, they’re going to become accustomed to right clicking everything and saying “run as administrator”, then complain at you because everything they want to do that involves their cd-rom or nearly any aspect of the system requires them to “run as administrator”.
Administration rights, great in concept, perfect in an environment where people know what they’re doing. Not a silver bullet for home users. The only way to protect home users is to educate.
