It means that every user effectively has root privileges. Which means that every user can eavesdrop on other users, view their saved data and files (unless encrypted on disk), intercept their network communications, impersonate them, steal their passwords (system, application, external web sites).
How bad that is depends on your particular use case. But for pretty much any setup where security is a concern or there's any sensitive data at stake, this is a very serious issue.
However, in the case of Windows, this issue isn't that much severe as it would be on a unix-like, for example.
With the set up of Windows servers I've seen, only the admin logs in anyway. It's not really used as a "multi-user" system per-se, where you get different users logging in at the same time. It does happen, but it's not common.
Hahah, I figured Windows might be slightly better about this, hence the self-admitted uninformed take.
Could you clarify, though: do you mean to say Windows isn't as vulnerable because of cultural reasons (i.e. Windows systems aren't multi-user usually) or because of technical ones (they support something like SELinux out of the box)?
This is pretty much how I was interpreting it. For context I did an internship at a bank, I had access to a computer and login credentials, but not admin access. I get the feeling that this would be a hair on fire problem there if like you said it'd mean me effectively having root.
Comments
A not-particularly informed take:
It means that every user effectively has root privileges. Which means that every user can eavesdrop on other users, view their saved data and files (unless encrypted on disk), intercept their network communications, impersonate them, steal their passwords (system, application, external web sites).
How bad that is depends on your particular use case. But for pretty much any setup where security is a concern or there's any sensitive data at stake, this is a very serious issue.
However, in the case of Windows, this issue isn't that much severe as it would be on a unix-like, for example.
With the set up of Windows servers I've seen, only the admin logs in anyway. It's not really used as a "multi-user" system per-se, where you get different users logging in at the same time. It does happen, but it's not common.
Hahah, I figured Windows might be slightly better about this, hence the self-admitted uninformed take.
Could you clarify, though: do you mean to say Windows isn't as vulnerable because of cultural reasons (i.e. Windows systems aren't multi-user usually) or because of technical ones (they support something like SELinux out of the box)?
The impact isn't as severe, for cultural reasons.
This is pretty much how I was interpreting it. For context I did an internship at a bank, I had access to a computer and login credentials, but not admin access. I get the feeling that this would be a hair on fire problem there if like you said it'd mean me effectively having root.