Login security problem during fast user switching

Question

Here are the steps to reproduce the security problem I'm seeing on my system:
1) Users A and B are logged in.
2) User A was the last user and user A put the system to sleep.
3) User B wakes the computer from sleep and sees the login prompt asking for user A's password.
4) Instead of clicking "Switch Users," user B enters his username into the username field (where user A's is already provided) and user B enters his password.
5) User B then goes to user A's account.
In short, user B is getting into user A's account. More about my particular setup: I have two accounts on the computer, one for work and one for personal use. Though they're both mine, the accounts have different usernames, long names and passwords. Both are administrator accounts. The above isn't reproducible with a standard user account, only administrator accounts.
I created a third administrator account and tried the same steps to get access to an account. The third admin account could also be sent into the last user's account (the user who put the system to sleep). A new standard account could not.
I'm guessing this is something peculiar to my setup, but can anyone else reproduce this on their system? Or it could be my search didn't pull up a thread where this is already discussed.
thanks in advance,
jody

Answer 1

Joseph Tate wrote:
Both are administrator accounts.
That's why.
This is a well known phenomenon. It isn't a bug. Admin users pretty much own the machine, they can do anything they want with their own admin password.
It is not a good idea to use an admin account for everyday use because it introduces security risks. Admin accounts should only be logged into for admin purposes. I recomment keeping your newly created admin account, and changing your other two accounts to standard, and then continue using them normally. This is a much more secure setup, it is what Apple recommends, and will solve the "problem" of User A unlocking User B's screen and vice versa.
Even when you need to do an admin task like installing software, there's no need to actually log in to the admin account. You can do this from either of your non-admin accounts simply by entering the admin username/password when prompted. I do admin and even root tasks from my non-admin account this way all the time. It has been months since I actually logged in to my admin account.