99

It's common knowledge that if somebody has physical access to your machine they can do whatever they want with it1.

So why do we always lock our computers? If somebody has physical access to my computer, it doesn't really matter if it's locked or not. They can either boot a live CD and reset my password or read my files (if it's not encrypted), or perform a cold boot attack to get my encryption keys from memory (if it is encrypted).

What's the point of locking a computer besides keeping the average coworker from messing with your stuff? Does it provide any real security benefit, or is it just a convenience to deter untrained people?

1. unless the computer has been off for a while and you're using full-disk encryption

Improve this question
12
  • 31
    Prevents casual fiddling. Network resources aren't available unless you have access to the account on the DC so the boot disk gets you nowhere. One of our company's worst kerfluffles was when an office manager got in the habit of leaving her computer in payroll and one of the clerks decided to use that information. Being in the habit of locking would have prevented the issue, or not leaving the program up in that window, etc. While your premise is correct, it is overthinking around the real reason locking or logging out is used.
    – Fiasco Labs
    Commented Oct 22, 2012 at 0:18
  • 46
    Actually, the complete phrase is "they can do whatever they want with it given enough time". Also, by the same token in theory anyone can pick a cylinder or tumbler lock, most people don't have the equipment/practice to do it with them on a daily basis.
    – Shadur-don't-feed-the-AI
    Commented Oct 22, 2012 at 9:15
  • 5
    Most of the answers seem to be about locking the screen, but the question has the physical tag. So I would assume the question is about physically locking up the computer itself. What do you mean locking the computer?
    – emory
    Commented Oct 22, 2012 at 13:07
  • 9
    Keep in mind that loss of data isn't the only risk here... Any actions performed from your session look like they were done by you. And not locking your screen could be considered negligence. You've left your front door wide open and courts may not look in your favor in cases like this.
    – Micah Henning
    Commented Oct 22, 2012 at 15:37
  • 5
    @emory, the question was indeed about locking a screen. The physical tag was used because an unlocked computer is still a physical problem (i.e. physical access is the problem). Sorry for the confusion!
    – Tom Marthenal
    Commented Oct 22, 2012 at 15:56

13 Answers 13

Reset to default
123

In some places they have a saying: "opportunity makes the thief". All you're doing by screen-locking a computer is making the cost of hacking it just a little bit harder.

Security is an economic good, with a price and a value. The value of locking is somewhat larger than the price of locking it. Sort of like how in good neighborhoods, you don't need to lock your front door. In most neighborhoods, you do lock your front door, but anyone with a hammer, a large rock or a brick could get in through the windows. In some neighborhoods, not only do you lock the door, you have a solid-core door with a deadbolt, and you have steel gratings over the windows. In the best neighborhoods, the value of the steel gratings isn't worth the price, but in bad neighborhoods, the value does exceed the price.

Improve this answer
7
  • 10
    The saying I've heard is that locks keeps honest people honest but it's the same premise.
    – Michael Brown
    Commented Oct 22, 2012 at 14:32
  • 2
    Heavy security also attracts criminality, because where there is heavy security, there is something to hide.
    – gerrit
    Commented Oct 22, 2012 at 16:08
  • 7
    "Good fences makes Good neighbors" - Mending Wall, Robert Frost
    – Mark Rogers
    Commented Oct 22, 2012 at 16:23
  • 3
    @gerrit perhaps you are right. Could you provide your residential address so I can verify you have nothing to hide?
    – emory
    Commented Oct 22, 2012 at 17:26
  • 1
    @emory My point is about not drawing attention.
    – gerrit
    Commented Oct 22, 2012 at 20:02
58

It's a risk management thing, really. An attacker with a short window of opportunity (e.g. whilst you're out getting coffee) must be prevented at minimum cost to you as a user, in such a way that makes it non-trivial to bypass under tight time constraints.

Hitting WinKey+L or clicking the lock button is next-to-zero cost for you as a user. Taking the time to reboot the machine, load up a live CD and extract the data (e.g. documents, SAM database, etc.) is not a short process - it's at least a 10 minute job and the reboot alerts you to a potential problem. The cost for the attacker is significantly greater than the cost for the user.

It's also a great way to prevent the casual attacker - e.g. the journalist you leave in your office for 5 minutes whilst you take a work call. If they see your computer unlocked, with all its data immediately available, they may take the opportunity. If they see that it's locked, they won't bother. 99% of visitors do not come equipped with data exfiltration equipment!

Improve this answer
9
  • 8
    Hitting WinKey+L or clicking the lock button is next-to-zero cost for you as a user. ... I disagree... the real cost is having to type your password again to get in... not a huge cost but not next-to-zero either
    – SplashHit
    Commented Oct 22, 2012 at 16:08
  • 1
    I guess my experience has been tainted by always having a biometric device available, which takes less than a second to use.
    – Polynomial
    Commented Oct 22, 2012 at 16:23
  • 4
    @SplashHit It is a next-to-zero cost compared to other security measures, such as having a encrypted dongle required to gain access to the system. Perhaps over the course of a significantly long period of time, the time lost to typing in a secure password versus having a physical object unlock the system would justify the initially costlier system, but it's not an issue for most computer users.
    – user8459
    Commented Oct 23, 2012 at 1:42
  • 2
    @Polynomial The funny thing is that most of those are actually way easier to crack than a password. One could get your fingerprints anywhere without you even knowing. A password can only be obtained by physical access to you, a blowtorch and some pliers.
    – TC1
    Commented Oct 23, 2012 at 10:10
  • 1
    @TC1 or a post-it next to the keyboard..
    – Thomas
    Commented Oct 23, 2012 at 13:07
26

Locking your computer prevents surreptitious snooping or alteration. If you don't lock, it is easy for someone to poke around inside your session in such a way that you will not notice it when you return to your machine.

The security benefit is real because there is a class of attacker who wants access without leaving any trace whatsoever. For that class of attacker, rebooting your machine and messing with your password are not options, unless that attacker is confident that he or she can restore your computer to very closely resemble the state in which you left it.

It is one thing for security to be compromised, and another for it to be compromised without a trace.

There is an analogy there with physical security. If you don't lock your doors and windows, then a thief can enter your house without leaving any trace of entry. The thief can steal something such that you do not even notice that it's missing until much later, perhaps months, if not years. One day it occurs to you, "Don't I own such and such a thing? Now where is it?" then waste time looking for something that, unbeknownst to you, was stolen long ago. Insurance people call this situation "mysterious disappearance".

If a thief does enter, it is better if there is evidence of forced entry.

Improve this answer
1
  • 8
    In-line with the part about locking a house, few bystanders would question someone walking up to a house and entering through the front door. The assumption is that the person entering it has a reason to. If a bystander watches someone break into a window, they're much more likely to call the authorities. This is analogous with sitting down at a computer that's unlocked, vs physically hacking into the system after crawling under a desk.
    – zzzzBov
    Commented Oct 22, 2012 at 17:44
25

"What's the point of locking a computer besides keeping the average coworker from messing with your stuff?"

By protecting your self from average coworker you've protected your self from largest subset of people who'd want to find something personal about you or do you harm.

Improve this answer
12

In most environments where it is necessary to lock your computer, what you are protecting isn't on your computer, but on networked computers which you have access to through your credentials. So a quick boot using a CD doesn't directly give the attacker anything useful, it is just a single step. While you are right that ultimately this isn't a barrier to a determinined attacker, it is a barrier to a an opportunistic hacker.

Think of a bank teller computer -- if you are making a deposit and they were to walk away at the point of confirming your deposit amount it would be easy to go ahead and complete the transaction with 10,000 instead of 10 dollars. If the computer is locked, even after they reboot, they won't have the same access.

Improve this answer
10

In addition to all the other answers, think about skill. If I come across an unattended, unlocked laptop, it takes no particular skill to send an email from that computer to the Company President; that email can range from prank to criminal activity. The other attacks you describe require a bit more skill.

Reinforcing what others have said, security is risk management. We need to compare work factor to deploy the control to the impact it has on the adversary's work factor. Locking the computer is very low work factor, but forces the attacker into an attack script that requires more time and skill.

Improve this answer
10
  1. It takes time to boot to a live CD
  2. Modifying the hardware will attract attention whilst simply using someone else's PC won't
  3. More people will attempt to use an unlocked PC then a locked one in the same way you're more likely to have your bike stolen without a bike lock than with an unlocked bike lock on it.
Improve this answer
10

Security is not only about the document located on your computer. Without a proper authentication to the company, someone having access to your machine should not have access to your emails (unless stored locally) and can't access network resources with your name.

When we say that having physical access is like losing this machine, it also implies that the attacker have time to act. If the attacker does not have time, he can't possibly boot an offline password breaker to change your password, access your data and getting what he wants. Furthermore, the process is destructive and alarm will be given as soon as you find your account has been accessed.

An other scenario would be if the attacker want to get something that is not stored on the computer, for example your password for a given application (corporate or private). Physically breaking in is not an option, as he wants to remain stealth. Howerver, if you provide the attacker with a sufficient window of time to install a keylogger.

In term of risk, it is also more probable that someone will attack your unlocked session, rather to steal or break physically your machine. Thus, it is a good measure to lock your session whenever you leave your office/desk.

Improve this answer
8

You can't ever make something completely secure and still make it accessible. Therefore, you can't ever prevent anyone from gaining access to your computer system. All you can do is make it harder for them to gain access. And in the case of locking your screen, a simple two-second stroke of the fingers can bring great inconvenience to someone wanting access. You effectively, exponentially increase the skill, cleverness, and knowledge required to gain that access.

Improve this answer
6

I'm no security expert by any stretch - but this really just seems like common sense. The average criminal isn't an Eastern-bloc spy; they just want to pick the low-hanging fruit from a tree in someone else's yard. If you lock it up, you push the fruit to a higher branch.

Improve this answer
8
  • 2
    I'm not quite sure how the video is relevant at all. It has little to do with locking the computer in any sense.
    – Iszi
    Commented Oct 22, 2012 at 13:45
  • His computer and external hard drives were stolen because, as the host stated, he didn't properly secure his own home from burglary.
    – user15249
    Commented Oct 22, 2012 at 15:40
  • A fair enough point, I suppose. However, the clarification given by the OP - that this question is about locking the computer session, not physically securing the environment - renders the video entirely irrelevant.
    – Iszi
    Commented Oct 22, 2012 at 17:05
  • Well, thank you for the clarification. But, nonetheless, in the video, he also failed to lock and encrypt his computer, thus allowing the burglar to (assuming it was the perp in the video) to use it for himself, or fence it.
    – user15249
    Commented Oct 22, 2012 at 22:18
  • Thank you for the clarification. But, nonetheless, in the video, he also failed to lock and encrypt his computer, causing data compromise. Of course, that ended up helping him get his computer back. But regardless, locking the computer and encrypting his files would have been fair preferable - a moronic burglar would not have the skills (or inclination to acquire them) to circumvent disk encryption, and have had no choice but to reformat. But hey, who am I tell people what to do? If people don't want to lock their session, then more power to them. (Sorry, I hit enter by mistake before)
    – user15249
    Commented Oct 22, 2012 at 22:26
5

Locking the workstation impedes anyone's attempt to accidentally peek into your documents, email or pictures. There is a difference between locking and making something hackproof!

Improve this answer
4

Another commonly omitted aspect of locking your computer is dismissing others from liability. The principle is similar to why you avoid leaving your password written on a piece of paper on your desk. By not doing that you're not only protecting your privacy but you are also protecting others from getting accused of knowing it. Because you reduce the probability of that happening significantly.

Their intent doesn't have to be malicious either. Someone's computer might be broken and yours could be the only computer unlocked, so he could assume that as "available" and do his work on your machine and accidentally destroy all your work. Locking your computer saves them from the responsibility.

Of course a computer can be breached even when locked by advanced users similar to how someone can guess your password by just trying your cat's name. By locking your computer, however, you change the odds in both your and your colleagues'/roommates' favor.

Improve this answer
3

Usually other people in your office are annoying gits - it doesn't always matter about security, it may just be something annoying - changing a wallpaper or similar!

... just see this for ideas - https://superuser.com/questions/275894/how-to-mess-up-a-pc-running-windows-7

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .