Maybe a rather noobish question: Why is CTRL+ALT+DEL required at login on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view it's a bad idea, adding an extra step in getting access. So does it improve security in any way, and if so, how?
This combination is called a Secure attention key. The Windows kernel is "wired" to notify Winlogon and nobody else about this combination. In this way, when you press Ctrl+Alt+Del, you can be sure † that you're typing your password in the real login form and not some other fake process trying to steal your password. For example, an application which looks exactly like the windows login. An equivalent of this in Linux is Ctrl+Alt+Pause
† This implies a trust in the integrity of the system itself, it's still possible to patch the kernel and override this behaviour for other purposes (malicious or completely legitimate)
Ctrl-Alt-Del is the Secure Attention Key on Windows. The operating system enforces a strong non-interception policy for this key combination.
You could make an application which goes full-screen, grabs the keyboard, and displays something which looks like the normal login screen, down to the last pixel. You then log on the machine, launch the application, and go away until some unsuspecting victim finds the machine, tries to log on, and gives his username and password to your application. Your application then just has to simulate a blue screen of death, or maybe to actually log the user on, to complete the illusion.
This attack is defeated by the SAK. Your application can grab the keyboard and redirect all keypresses to itself, without needing administrative rights, except the Ctrl-Alt-Del, which the OS never allows to be redirected. Pressing Ctrl-Alt-Del ensures that you get the genuine logon screen, not an imitation.
The answer to this can actually be found on our sister site, ServerFault. How does CTRL-ALT-DEL to log in make Windows more secure?
To quote the accepted answer by Oskar Duveborn,
Some additional questions have been raised regarding Windows 8 SAS support, and a later deleted by owner separate question was posted about it, too. Since I've already started writing my answer to that question, and Windows 8 has also been mentioned in this thread, I'm thus posting it here. If that deleted question reappears, I'll move my answer there. Hopefully, it will help those that were wondering where SAS went on Windows 8 phones and tablets.
According to Windows 8 Hardware Certification Requirements as mandated by Microsoft:
So this is not a case of Secure Attention Key disappearing altogether (on keyboardless devices, others can still use SAS as before), and a combination of two standard hardware buttons Win+Pwr was merely added to the still exisiting Ctrl+Alt+Del combination to better support devices without a hardware keyboard, which is what Windows 8 was also designed for.
Of course, since it's not merely an operating system for portable devices without a physical keyboard, but also desktop computers that wouldn't have these Win+Pwr physical buttons (but they do have a keyboard), the old SAS method was still kept. If, for whatever reasons, you'd like to disable/re-enable this support, this blog (or this) explains how you could achieve that in a few simple steps.
Another related question (or more of a request really) was raised by @Iszi in the Requests for Question of The Week blog posts discussion on IT Security Meta: "I find it especially interesting to discover that Windows & Linux don't necessarily use the same Secure Attention Key. It would be nice if someone could expand a little upon that.". Since I'm already a late-to-the-party bottom feeder on this question here, and nobody can really accuse me of hijacking the rep train  it turned up to be - well, here it goes:
Main difference between the two implementations that I could find is, that the Linux SAK (yes, this is the acronym used in Linux in contrast to the SAS (Secure Attention Sequence) used in Windows) is that the Linux SAK never earned the National Computer Security Center's (NCSC) C2 security rating. Windows NT has:
But this still doesn't really explain why
It goes on explaining how to create a custom SAK handler, but the main takeaway is that the implementation differs greatly from what can be found in Windows as SAS, and that they might not be implemented at the kernel level, depending on what whether
Does it explain why different keyboard sequences were chosen? I'm not sure. It shows why there is more than a single such keyboard sequence in Linux and what the differences between them are (see Andrew Morton's explanation), but I couldn't find a clear answer on why was one chosen over the other and why different kernel builds might use different SAK combinations. I can only suspect that it boils down to personal preference of their respected authors.
The idea is that a trusted Windows process called Winlogon, and only Winlogon, can read the Ctrl+Alt+Del key sequence. This key sequence is called the secure attention sequence (SAS). By entering this key sequence, you are basically "proving" to yourself that it is Windows that is accepting your input. This guards against a malicious program intercepting your login credentials by creating a fake username and password form. Of course, this assumes that Winlogon is not compromised, and it may so happen that Winlogon has been tampered with so that this measure can be bypassed.
If you're presented with a login prompt without being required to press Ctrl+Alt+Del on a system configured to do so, do not enter your login credentials, because this means that a program has highjacked the login prompt. Either notify the system administrator (if the computer is owned by your company) or clean any malware on the system (if you own the computer).
The same applies with Windows 8, only that there is an additional SAS, Win+Power, for tablets which do not have a physical keyboard (Surface comes to mind).
Ctrl+Alt+Del was around way before Windows Logon, originally it simply did a soft reset on the system. The same combination is on other systems/OSs too (Atari ST springs to mind).
If the question is "why these three keys" then I would say because they are hard to push and a mistake is therefore hard (as people have said).
If the question is "why does Windows (now) use it" then I do not know, maybe because user where familiar with it it was chosen. You will need to ask the person(s) that made that decision, I am fairly sure the actual keys pressed are arbitrary (but now I am thinking it may be a low level hardware interrupt).
Another part of the reason - AFAIK - is to be found when considering the choice of key combination: It is very difficult to press all of Ctrl, Alt and Del at the same time with a single hand; and it is also very unlikely that all 3 keys will be pressed at the same time by something hitting the keyboard, or by you sort of banging on it etc. As David Bradley choose this combination to trigger a soft reboot (Wikipedia), it was important for it not to be triggered by mistake. This caught on for things like bringing up a user login prompt; the idea is to make you demonstrate your intention by explicitly deciding to press an "difficult" key combination (e.g. before logging in).
Of course, that's not about Windows but all PC software and firmware which utilizes Ctrl+Alt+Del.
protected by Jeff Ferland♦ Apr 29 '13 at 18:09
Thank you for your interest in this question.
Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?