How many people am I sharing my computer with?

Question

I believe I am the only person using my computer. Is there any way to definitively (securely) tell?

I have a Windows (7) laptop on a Wireless Network with a reasonably cryptic password, but I close the lid and walk away regularly, leaving it alone for hours/days at a time in stand-by mode. There's no password on the login for it, but then the house is locked, and in any case it's "off", right? Is that naive? Is there any secure log of logins to my computer that I can trust?

Motivation/example: I never store my online banking password (and tell Firefox as much) and yet I just logged in to my bank through Firefox, and there was the login and password auto-filled for me.

Naturally I sought a way to clear the saved password. I found it... but also a way to show the saved password without further security clearance (Master password, etc).

Clearly anyone with access to my computer can easily read my passwords... which horrifies me.

But all that is probably fine so long it was my slip-up, and nobody else is actually using my PC. But how can I tell? In particular, how can I know that I can trust any activity logs (or similar) - that the logs themselves are secure?

Answer 1

Since you mentioned you are using a Windows computer, here is a site which will describe how to activate 'Audit Logon Events' if it's not already activated. Here is a brief description of what ALE is:

Audit Logon Events:

The Audit logon events setting tracks both local logins and network logins. Each logon event specifies the user account that logged on and the time the login took place. You can also see when users logged off.

However as far as Firefox goes, I can say that you don't have to worry about security if you set your browser up correctly. Here are a few links that might help you in your current situation:

Delete Saved Passwords in Firefox

Password Manager - Remember, delete, change and import saved passwords in Firefox

Settings for privacy, browsing history and do-not-track

The links provided are reputable links, including some from Mozilla (Creators of Firefox), so you can trust the information coming from them.

Additional Actions

Also if you are really cautious, you can download a program called 'CCleaner'. It's a very common cleaner for windows users which will take care of web browser data such as: cache, passwords, and history. It can also do much more if you want it to. Here is a link to CCleaner

Answer 2

yet I just logged in to my bank through Firefox, and there was the password pre-typed for me, stored along with my login.

Whether or not a password gets saved is going to be a combination of factors involving the HTML and Javascript of the page and how your browser interprets both.

Normally banks apply some JS trickery to stop passwords from being saved on local browsers, but if someone on the bank's end modified the webpage or your browser maker got wise and countered their safety measures for the sake of convenience, said trickery may not have kicked in, and your browser may have popped up a "do you want to save your password?" prompt you clicked through at some point.

Naturally I sought a way to clear the saved password. I found it... but also a way to show the saved password without further security clearance (Master password, etc).

Clearly anyone with access to my computer can easily read my passwords... but I never new, and I'm horrified about it.

But that's probably ok so long as nobody else has been using my PC. How can I tell? And how can I trust what I'm told?

Clever on your part.

If you aren't using full-disk encryption, anybody who mounts your drive on another computer can simply navigate to the file your browser uses to save passwords and retrieve the whole list. This won't trigger any Windows audit events, so short of using tamper-proof equipment you'd never be the wiser.

To be safer in your situation (depends on who you're protecting against) you need to use some sort of full-disk encryption (Bitlocker, Veracrypt, etc) and stop putting your computer in standby mode. If you were using FDE, you'd just be putting it to sleep unencrypted. Shut it down when not in use.

Answer 3

If you want to tell if someone's using it remotely, two easy options that avoid your potentially compromised operating system entirely:

• Pull the battery, and plug the laptop into AC using a Kill A Watt and see how much power it drew; compare to a known running and known sleeping measurement.
• Use something like Smartmontools to track hard drive power on hours; check before closing and after opening.