My new workplace laptop is configured so that after I log off and log on, rather than the last-logged-in user being selected by default, I have to hit ctrl-alt-del and then enter my username and password.

This seems like a security issue because I have 20 years of muscle memory built up around hitting Ctrl-Alt-Del and then immediately entering my password. (This is what I always did after either unlocking a machine that had been locked, or logging on to a machine that had my username selected by default because I was the last-logged-in user.) This means that I keep hitting Ctrl-Alt-Del and entering my password in the username field where someone shoulder surfing might see it.

To make matters worse, if I unlock the machine, I hit ctrl-alt-del and enter my password, but if the machine has been rebooted while I was away (to install updates, for example), I have to hit ctrl-alt-del and enter my username and then my password, which means I'm likely to do it wrong unless I always pay attention to whether I'm looking at the lock screen, or the logon screen. (An attacker might even power cycle the machine in order to bring up the logon screen instead of the lock screen, and then hang around waiting for me to hit Ctrl-Alt-Del and type my password into the username field out of habit. Or they might wait for a day when lots of people's machines have been rebooted due to an update, and then hover over as many people as possible to see if they do the same thing!)

So, for this reason, it seems worth recommending as a standard practice for individually assigned laptops to always have the last-logged-in user selected by default when you hit Ctrl-Alt-Del to log in. Am I missing something? If I am right, is this in fact documented as a standard best practice somewhere?

(Presumably, the point of the don't display-last-login feature is to reduce "information disclosure" to paranoid levels, such that even the next user of the machine doesn't know who the last user is. But I would argue that in the case of an individually assigned laptop, (1) 90% of the time, people know that the last-logged-in user was me anyway, and (2) if someone else used their account to log in to my laptop, I should have that information when I resume using my machine anyway. In either case, it doesn't seem to outweigh the potential risk of users typing their password into the username field where someone might see it.)

(Also, I know how to change it -- go to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options and change "Interactive logon: Don't display last signed-in" from "Enabled" to "Disabled," but that's not what I'm asking.)

  • 1
    As a general rule, best security practices are not to provide help to attackers, by prefilling the username field for them. This is a very long personal rant, not a technical question, which basically boils down to “I don’t want to have to pay attention before I login.” – Don Simon May 8 at 22:53
  • @DonSimon couldn't have said it better myself. Apparently he doens't like my answer. – leaustinwile May 8 at 22:56
  • There is a school of thought that "If something is due to user error then it's not a security hole and we don't have to fix it." What this fails to take into account is that some configurations make user error more likely than others, which increases the probability of an attack. – Bennett May 9 at 22:19
  • @leaustinwile I don't know what you mean by "Apparently he doens't like my answer" since you wrote that before I even logged in to see your answer – Bennett May 9 at 22:35

You're overthinking it. Usernames aren't typically confidential information. Their usually the same format as your corporate e-mail address and thus easily deducible by an attacker. If someone is shoulder surfing then you should hit them in the face. Requiring a user to enter their username is not a vulnerability by itself. If that username was then insecurely transmitted somehow where an attacker could intercept it, it would be a vulnerability.

I see what you're saying, you're saying that because you're used to entering your password without the username, that you may enter it into the unprotected login field. The thing is, if you do that, it's human error. It's not a technical vulnerability. Similar to how getting phished is human error as opposed to a technical vulnerability.

In pentesting we wouldn't classify that as even a low vulnerability. Because the attacker wouldn't be able to get that information from the device unless they were physically present or already have malware on the device. The attacker isn't exploiting any inherent weakness other than the human link/interaction with the tech. What your explaining is just an oversight in your judgment and is not considered a cyber risk. Recommendation: if it's a major problem for you, disable it. Otherwise, pay more attention to where you enter your credentials.

  • One difference from phishing is that phishing happens entirely outside the control of the real website that the phisher is imitating, so there's little they can do to stop it. The scenario I'm describing is also human error but it's happening entirely on the company's own equipment, which means they can do something to reduce the likelihood of error. – Bennett May 9 at 22:37
  • That's actually also not correct. Phishing often time happens because of a cross-site scripting vulnerability that allows an attacker to inject malicious IFrames into the legitimate website pages that request credentials, overlay the real site with a different phishing site, etc... And yeah, they could, but the amount of overhead required with implementing that policy simply isn't worth it. If you get hacked because you let someone watch you type your credentials in, you don't deserve a job with that company. Simply because you don't respect it enough to protect your security info. – leaustinwile May 10 at 2:51
  • the "amount of overhead" is setting a bit to a 1 instead of a 0 at the time you set the work laptop policy defaults – Bennett May 10 at 18:36

It would not seem safe to say that it is a best practice to display the last logged in user.

If someone steals your laptop, they now would have your login username and just have to guess your password, dictionary password attack, brute force, etc. If they are lucky, you may use the same username and password for other work related things and there maybe a dump of passwords from (a "haveIbeenpwned.com" type of lists for example)

Even if you are good about not re-using passwords and not using the same or similar username for other services, all your co-works may not be, and these type of policy changes are trying to cover the majority of use cases.

You are calling out a possible attack vector, and how to go about exploiting it, but from your workplace perspective the odds of some 'random' person stealing your laptop is higher then someone taking the time to target you, stalk your habits, ID this is a new introduced change, and hopping your muscle memory has not changed to the new style. Short term there is a gap, but long term they filling a bigger gap.

the Institute of Standards and Technology, Security Technical Implementation Guide calls this out: https://www.stigviewer.com/stig/windows_7/2016-07-22/finding/V-11806

  • One minor comment...The STIGs are not produced by NIST, but by DISA specifically for the United States Department of Defense. And in my experience, in practice, this one is universally ignored by the entire DoD, including DISA itself. In fact, since it's a Windows 7 STIG, they may have dropped it entirely for newer OSes. I'd have to check. – Xander May 9 at 12:33
  • 1
    @Xander Thanks for the clarification you are correct. Ya, it's not in the Windows 10 STIG, 7 was the latest entry, I almost did not list it because of that, but I was just noting it as an example, as it's statement is still relevant to why an admin may want to not show the last login. I was not trying to imply it's a best practice to remove it, but was saying it's not necessarily a best practice to keep it. – NickG May 9 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.