is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?

Question

My new workplace laptop is configured so that after I log off and log on, rather than the last-logged-in user being selected by default, I have to hit ctrl-alt-del and then enter my username and password.

This seems like a security issue because I have 20 years of muscle memory built up around hitting Ctrl-Alt-Del and then immediately entering my password. (This is what I always did after either unlocking a machine that had been locked, or logging on to a machine that had my username selected by default because I was the last-logged-in user.) This means that I keep hitting Ctrl-Alt-Del and entering my password in the username field where someone shoulder surfing might see it.

To make matters worse, if I unlock the machine, I hit ctrl-alt-del and enter my password, but if the machine has been rebooted while I was away (to install updates, for example), I have to hit ctrl-alt-del and enter my username and then my password, which means I'm likely to do it wrong unless I always pay attention to whether I'm looking at the lock screen, or the logon screen. (An attacker might even power cycle the machine in order to bring up the logon screen instead of the lock screen, and then hang around waiting for me to hit Ctrl-Alt-Del and type my password into the username field out of habit. Or they might wait for a day when lots of people's machines have been rebooted due to an update, and then hover over as many people as possible to see if they do the same thing!)

So, for this reason, it seems worth recommending as a standard practice for individually assigned laptops to always have the last-logged-in user selected by default when you hit Ctrl-Alt-Del to log in. Am I missing something? If I am right, is this in fact documented as a standard best practice somewhere?

(Presumably, the point of the don't display-last-login feature is to reduce "information disclosure" to paranoid levels, such that even the next user of the machine doesn't know who the last user is. But I would argue that in the case of an individually assigned laptop, (1) 90% of the time, people know that the last-logged-in user was me anyway, and (2) if someone else used their account to log in to my laptop, I should have that information when I resume using my machine anyway. In either case, it doesn't seem to outweigh the potential risk of users typing their password into the username field where someone might see it.)

(Also, I know how to change it -- go to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options and change "Interactive logon: Don't display last signed-in" from "Enabled" to "Disabled," but that's not what I'm asking.)

Answer 1

You're overthinking it. Usernames aren't typically confidential information. Their usually the same format as your corporate e-mail address and thus easily deducible by an attacker. If someone is shoulder surfing then you should hit them in the face. Requiring a user to enter their username is not a vulnerability by itself. If that username was then insecurely transmitted somehow where an attacker could intercept it, it would be a vulnerability.

I see what you're saying, you're saying that because you're used to entering your password without the username, that you may enter it into the unprotected login field. The thing is, if you do that, it's human error. It's not a technical vulnerability. Similar to how getting phished is human error as opposed to a technical vulnerability.

In pentesting we wouldn't classify that as even a low vulnerability. Because the attacker wouldn't be able to get that information from the device unless they were physically present or already have malware on the device. The attacker isn't exploiting any inherent weakness other than the human link/interaction with the tech. What your explaining is just an oversight in your judgment and is not considered a cyber risk. Recommendation: if it's a major problem for you, disable it. Otherwise, pay more attention to where you enter your credentials.

Answer 2

If you mistakenly enter a password into the username field and press return with a blank password, that will be recorded in the Windows Security log as a failed login attempt. The username (actually password) will be visible there in plain text. However read access to the security log is, by default, limited to Administrator level accounts. You can argue that this is poor usability and giving an inconsistent user experience but this scenario is only a security risk if you don't trust the administrators.

Answer 3

It would not seem safe to say that it is a best practice to display the last logged in user.

If someone steals your laptop, they now would have your login username and just have to guess your password, dictionary password attack, brute force, etc. If they are lucky, you may use the same username and password for other work related things and there maybe a dump of passwords from (a "haveIbeenpwned.com" type of lists for example)

Even if you are good about not re-using passwords and not using the same or similar username for other services, all your co-works may not be, and these type of policy changes are trying to cover the majority of use cases.

You are calling out a possible attack vector, and how to go about exploiting it, but from your workplace perspective the odds of some 'random' person stealing your laptop is higher then someone taking the time to target you, stalk your habits, ID this is a new introduced change, and hopping your muscle memory has not changed to the new style. Short term there is a gap, but long term they filling a bigger gap.

the Institute of Standards and Technology, Security Technical Implementation Guide calls this out: https://www.stigviewer.com/stig/windows_7/2016-07-22/finding/V-11806