If you’re the only person who ever uses your Mac, none of this applies. Otherwise, you should know a few things about what sorts of access other people may have to your data.
First, if everyone uses the Mac via a single account—without having to log in and enter a separate username and password—all bets are off. Whatever’s available to you is available to everyone else. I’m not a fan of that arrangement. Ideally, every human who uses your Mac should have a unique username and password. (I might make exceptions for kids too young to type their own passwords. See how to set up safe user accounts on a shared Mac.)
But let’s say each person does have a separate account and password, and each one diligently logs out (or shuts down the Mac) after every session before the next person logs in. Then what?
How ownership and permissions work
macOS, as a variety of Unix, relies on the properties of ownership and permissions for each file. To oversimplify a bit, each file and folder has a designated owner—usually one of the individual account holders or the system itself—and a set of attributes assigned to it that specify who can access it, modify it, delete it, or execute it, in the case of files. (Apple adds a number of Mac-specific attributes on top of that.)
But there are owners and there are owners. macOS Standard account owners can access files, apps, and folders in all public places, like the system-wide Applications folder, but they can modify and add items only in specific locations: their own home folder (/Users/username) and the Shared folder in the main /Users folder. No other standard user can view files in any other users’ home folders, except the default Public folder, which is read-only and has a Drop Box item (not Dropbox, the service) that other users can drag items into, but then not see afterwards (write-only). For day-to-day segregation of one person’s data from another, this system provides a reasonable barrier.
An administrator can assign additional access to all non-system files and folders by changing ownership to a user, creating a group and providing group read/write access to a folder, or changing permissions to make things readable and modifiable by anyone with an account.
Where the barrier breaks down
But that reveals the weakness, no? An administrator has “root” access, which is the top-level permission holder in Unix. Anyone with an administrator account and working knowledge of the Unix command line can access everyone else’s files by opening the Terminal app in /Applications/Utilities, entering sudo -s, and supplying the administrator account’s password.
They can also restart in recovery mode, and use Terminal there to avoid any safeguards or monitoring tools that might be installed in macOS. With an Apple silicon Mac, an administrator can share the entire Mac as a volume on another Mac via macOS Recovery, too.
Standard users also have some options to get around the protections that should prevent them from seeing other files:
- Filching your password: Anyone who knows or can guess your login password can log in as you and access all your files. Of course, you have a terrific password that you’ve kept completely safe from everyone else, right? Fine, but there are still other problems.
- Attach your Mac’s startup drive to another Mac as an external drive: If you start up your Mac from an external drive someone could attach that drive to another Mac to which they have administrator permissions and access all the files on it. If it’s protected with FileVault, they only have to have an account enabled for FileVault on the original Mac and know the password. While other users’ files appear locked when the Mac’s drive is mounted, they can be copied over and unlocked by entering an administrator account password on the destination Mac.
- Can’t attach volumes and other stuff while locked: Apple lets you require approval to attach new peripherals, SD cards, and other accessories to your Mac. See the Mac settings worth changing. If your Mac is locked, nothing can be approved.
- Connect your Apple silicon Mac to another Mac: Mac Sharing Mode is a feature introduced with Apple silicon Macs to let you mount one Mac as a volume on another Mac. Mac Sharing Mode turns a Mac into a file-sharing volume, instead of appearing as an externally connected drive. (This is functionally equivalent to, but less risky than, the Target Disk Mode available on Intel Macs.)
To use Mac Sharing Mode, connect an Apple silicon Mac to another Mac of any vintage with a USB or Thunderbolt cable. Restart your Mac in recovery mode, choose Utilities > Share Disk, and then select the volume to share. On the other Mac, the sharing Mac appears as a network volume.
In addition, someone who has access to backups of your files on mounted or unencrypted volumes or drives can likely access all of them without file ownership and permission getting in the way.
For all these reasons, the only safe assumption is that anyone else who has an account on your Mac or physical access to it could conceivably access your files. Although your data is fairly safe from casual access by nontechnical users, you should not think of ownership and permissions as a significant roadblock.
Moral of the story: Don’t give other people’s accounts administrator access if you don’t trust them and you can prevent giving them such privileges.
If you can’t, another option is to use encrypted disk images or volumes in which you keep the password to yourself. You can use the Finder to encrypt volumes and Disk Utility to create encrypted disk images; see how to turn on FileVault and encrypt your Mac. Unmount these disks when they’re not in use.
