Windows 10 seems to load session before user log in, is it safe?

Question

Last few days I noticed a really annoying problem with Windows 10 (not sure if it is caused by last update).

After computer is turned off gracefully, on next startup it loads completely session of the last user (I think the last) before anyone signs in!

Way to replicate:

1. turn off browser with playing music (in my case Firefox with Youtube)
2. turn off the computer gracefully
3. start the computer and wait on logging screen
4. after few minutes, the music from web browser starts to play (even though the browser/tab was not active on shutdown).

I tried to log in with another user, and the music stopped playing sometime during the login process, so I guess it abandons the loaded session at this point. On the next startup, the music started playing again.

It seems to me, that Windows 10 is trying to predict what user will log in next and preload his session before he logs in (or maybe it is just a terrible bug).

My question:

Has this feature (or bug) some security issues or is it just extremely annoying?

Edit By security issue I mean for example case that some user will introduce running keylogger to login screen from his account extremely easily.

Answer 1

One of the many small changes in Windows 10 Fall Creators Update is that the operating system can now automatically reopen programs that were running before shutdown or restart. If you shut down Windows 10 with some apps open, some of them are relaunched at next startup just like what is happening to you.

It usually opens the app or the window you didn't close when you hit the shutdown button by bookmarking that specific window or the application so that it automatically open when you restart or power on again.

If you want to start with no apps open (other than those set to auto-start via Task Manager/Start), you’ll need to ensure all apps are closed before shutting down or restarting the PC.

Though there is no way to turn the feature off in the user interface, there is a way to prevent Windows 10 from restoring previously opened programs after a restart.Microsoft suggests exiting programs manually before shutdown, so that they won’t be be relaunched after reboot. That’s the best practice.

You need not worry about the security of windows as it is the update officially from Microsoft itself.

Answer 2

Short answer: no it is not safe, it is speculative authentication.

This function is conceived to improve user experience and save him time on the session starting process. This function is a speculative anticipated application run based 2 strong hypothesis:

1. most of the time a PC is used by one uniq user: its owner,
2. most of the time the owner is the only user attempting to authenticate on his PC.

Then there is no problem to run applications under the identity of this anticipated user before his successful authentication.

To give you a simple image, this is exactly what any Intel processor is doing all the time with speculative execution of code to keep the processor at full speed all the time whatever the hardware instruction is doing.

You are right, this function is creating a real security problem as soon as one of these 2 hypothesis is wrong. Because the OS is running processes under the identity of a user who isn't authenticated on the system right now and who didn't explicitly allowed or asked some processes to run outside of his session and control.

Here is a practical example (shamelessly copied on your own one) to show an impact on legitimate user privacy.

1. I am at home looking at a video of a scene of crime of a rape,
2. it’s too late and I close my session as quickly as possible to sleep,
3. next day I bring my computer at my office,
4. I make a break for a coffee and let my computer off in our next meeting room,
5. seeing I am tired and late for the meeting, my best colleague, Alice, starts my computer in advance because everyone is already ready,
6. 30 seconds later all my colleagues sitted waiting for our meeting to start will hear the sound of the video I had started in private context,
7. upon my arrival at the meeting my boss ask me deadly cold "Could you please turn off your PC ASAP, and leave the meeting now.”.

I won’t describe here scenarios of attacks leaded with some applications running without the user consent, knowledge and authentication. I foresee many.

I advise you to report to Microsoft the risk of: application running before user authentication, and without user consent and knowledge.

To avoid leaks, and bad uses, I suggest to avoid communicating on scenarios of attacks.