Possible Security Vulnerability?

[EastHillWill]

Here’s the scenario: I nuked and paved my wife’s iMac, as it was acting a bit odd. Prior to doing so I used Time Machine to back up everything, including the user accounts. We both have separate admin logins, so I did the backup from mine (which pulls in all other users.) The backup was placed on an external drive.

I restarted the computer more than once, wiping the disk via terminal a couple times for good luck, and only upon the first cycle had to enter an admin password. Then I reinstalled macOS via Recovery.

After the installation I was presented with the option to restore from the Time Machine backup, which I plugged in the drive and did. My wife was the only user I selected to restore, as I didn’t want my account on there this time. Here’s where the security question comes in to play: It had me choose a new password for her—now the only admin/user on the machine—without verifying any of her information: Not the old computer password, not her iCloud, no device authorization code, nothing. After I did so it did the restoration and took us to her desktop, complete with all of her info. (Files on the desktop, etc.) It prompted me for her iCloud password at this point, but I otherwise had access to her account.

Does this scenario seem odd to anyone? Couldn’t anyone have taken that external drive and restored her account (and mine probably, which again I didn’t select) without knowing any personal information? The last authorization of any kind in this process was when I initially booted into Recovery and had to enter my password (since at the time I was an admin), but since that time the disk was wiped, the machine was restarted and macOS was installed. This particular instance wasn’t a big deal since it’s my wife, but it did get me thinking so I wanted to ask.

 

[Apple_Robert]

It sounds like you don't use an encrypted TM backup. I suggest you do that, in case the drive is ever lost or stolen, it can help protect the contents from easy retrieval.

 

[EastHillWill]

It sounds like you don't use an encrypted TM backup. I suggest you do that, in case the drive is ever lost or stolen, it can help protect the contents from easy retrieval

You’re correct that I didn’t choose the encryption option. However, I don’t think one user forgoing that option should lead to unfettered access to another user’s info. That seems like an oversight, leaving one’s privacy in the hands of another.

 

[BrianBaughn]

You’re correct that I didn’t choose the encryption option. However, I don’t think one user forgoing that option should lead to unfettered access to another user’s info. That seems like an oversight, leaving one’s privacy in the hands of another.

The computer and backup privacy is in the hands of the computer administrator. There's no "oversight".

 

[Fishrrman]

I don't see anything "out of the ordinary" with what you did.
I'd just "use it and be happy"...

 

[chown33]

Here's the root of any security oversight:

... We both have separate admin logins, so I did the backup from mine (which pulls in all other users.) ...

Anyone with an admin login has full access to anything that isn't encrypted.

If something is encrypted, and they also have the password, or a way of obtaining a key (e.g. a recovery key), then they also have full access to that.

It doesn't matter if there are separate admin accounts, each with its own password. The simple fact is that any admin account lets someone become the root user, which has unrestricted access. So once the admin user has become root, either as the real or the effective user ID, then there are no restrictions.

 

[EastHillWill]

The computer and backup privacy is in the hands of the computer administrator. There's no "oversight".

I don't see anything "out of the ordinary" with what you did.
I'd just "use it and be happy"...

Here's the root of any security oversight:

Anyone with an admin login has full access to anything that isn't encrypted.

If something is encrypted, and they also have the password, or a way of obtaining a key (e.g. a recovery key), then they also have full access to that.

It doesn't matter if there are separate admin accounts, each with its own password. The simple fact is that any admin account lets someone become the root user, which has unrestricted access. So once the admin user has become root, either as the real or the effective user ID, then there are no restrictions.

I understand what you’re all saying, thank you. My understanding was that admin privileges on macOS gave me access to everything *except* the personal files of other admin users, but that clearly isn’t correct. That’s not a decision I agree with, but I do understand it. Appreciate the feedback! I’m not a regular Time Machine user, so this was a new one to me.