First, let me say that I saw on the "Welcome" window that this site is for professionals, which I am not. But I don't really want an answer from someone who's not a professional, I want a good answer. I also saw a note to post questions about this site on the meta site; but you can't post on the meta site if you don't have 5 posts here. So, if I could ask this...

As I've been instructed over and over again, I put what I believe is a strong password on my home pc. But lately I've started to wonder if that's really even important, as long as I have a strong password on my residential gateway. There is no one here except my wife, who couldn't break the weakest password even if she wanted to. If someone steals the pc, they'll just take out the HD and get my data that way.

Considering these things it seems that all I really need is a good gateway password and my poor wife can go back to using her cat's name as her pc password. Am I right about this? Thanks in advance.

  • While the site may be for professionals, there is no requirement to be one to ask a question here, as long as the question meets the requirement of this site (which this one does).
    – forest
    Dec 1 '18 at 5:23
  • Adding to the @forest's comment. Actually AFAIK most questions are asked by non-proffesionals or who are new in this field on this site and professionals here usually answers the questions rather than asking :)
    – daya
    Dec 1 '18 at 13:17

You do need a strong PC password. The reason for this is that UAC, a security system on all Windows computers since Vista, can be configured to ask for a password whenever making important changes to a computer. Indeed, it should be configured to do so, as you should be running a non-admin account to avoid nasty security issues. If your password is weak, it could potentially allow malicious software to guess it and bypass the security controls. While Windows makes an attempt to prevent programs from tampering with UAC using a technique called UIPI, it does not always succeed.

You can safely enable auto-login without a password, however.

  • So it sounds like both our pc's need admin accounts with strong passwords, but non-admin accounts for everyday use with easy passwords.
    – user48053
    Dec 1 '18 at 3:07
  • 3
    @user48053 You don't even need a login password if you don't want, as long as the admin password (you should never be logged in as an admin) is strong, so when you need to do administrative tasks like installing new software or changing core system settings, the password cannot be guessed.
    – forest
    Dec 1 '18 at 3:10
  • If you encrypt the hard drive (HD) with Bit-locker (for example), you are safe against the HD being removed and accessed, but THAT needs a password that your router cannot provide. Above answer on UAC is very important as well.
    – Stone True
    Dec 1 '18 at 14:11

You should also use a secure password (on all accounts) if there is ever any possibility of somebody else getting physical access to the machine, unobserved, for a time. Guests, especially kids, may try to use the computer (with or without securing permission) and try to guess your password if they see a chance.

Also, if you are at all worried about the computer being stolen (which, if you stay logged into any accounts and the computer is at all portable, you should), I strongly recommend using disk encryption. The easiest way to do this on Windows is to enable BitLocker, and while BL can be configured to require a passphrase at bootup, by default (on compatible systems) it simply uses the TPM to ensure that the boot process hasn't been tampered with (for example, by somebody removing the hard disk and putting it in their own computer, or booting off a USB drive or Live CD). In that case, the login password on your account - on any of your accounts - is the primary line of defense against an attacker getting into your data.

  • If I take that HD (that has BL on it) and put it in another computer, and I know the login password it was originally used with, can I access the HD?
    – user48053
    Dec 1 '18 at 22:39
  • @user48053 No, because it requires the TPM from the original computer.
    – forest
    Dec 2 '18 at 2:38
  • @user48053 You would need to either have disabled or removed BitLocker on the original computer, or to use the "recovery key" (a very long random string that is automatically generated when BitLocker is first enabled, and which you are supposed to write down or put on removable storage and store someplace secure) to unlock the drive on the new computer. If your machine doesn't have a TPM (or you want extra protection) you can use BitLocker with a boot-time password instead of / in addition to the TPM, in which case the BL password needs to be good but the OS password doesn't matter as much.
    – CBHacking
    Dec 2 '18 at 6:23
  • With BL, I assume that, when I'm logged in to my computer, if someone were to come in through the network, then he would have access to everything in the pc that I do, correct? BL only protects the HD when the computer's not in use?
    – user48053
    Dec 3 '18 at 2:45
  • @user48053 That is correct. When I said a BL password means the OS password doesn't matter as much, that was specifically in the context of somebody stealing your computer; the OS password still matters a lot if you expect any attacks on the computer while it is operating (either via the local terminal or over the network).
    – CBHacking
    Dec 3 '18 at 7:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.