It's not that difficult to reset the password of the administrator account in MSWindows when you have local physical access to the machine Same thing applies on any Linux distro, it's possible to reset the root account password This means without encryption you have no security what soever on your PCs unless you make sure nobody has physical access to them.

Isn't this considered as a major security issue?

  • Even if they couldn't reset the password, they wouldn't need to. They can just boot a live CD or hook the disk up to another computer. Physically stealing a computer is much more risk and resource investment for an attacker than most attacks, though. Commented Aug 15, 2014 at 1:06
  • Rule of thumb: physical access is root access. There are some levels of protection you can add like full disk encryption, but with enough time and resources, an attacker can still get in.
    – cscracker
    Commented Aug 15, 2014 at 16:52

1 Answer 1


Law 3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.

It's a security risk, yes, but refer to this rule and read the link I posted. Actually, it'd be good to read that rule (Law 3) in addition to the rest of the Immutable Laws.

I'm not sure your question, "Are all OSes vulnerable to local password reset attacks" is within the scope of what we can answer; for instance, some popular operating systems might be, but perhaps there are a handful somewhere that aren't.

Passwords are sort of like locks. Locking your door might prevent a crime of opportunity, but it certainly won't deter a determined criminal. That's why you don't leave valuables in plain sight and you install an alarm system.

Think about it -- you can boot from a USB and read the data on the hard drive. That's a very possible attack vector. It accomplishes pretty much the same thing, yet saves them from having to go through the trouble of resetting the root/admin password. So, really, it's helpful for people who forget the root password, and isn't too much of an added vulnerability, because if it is an issue for you, then you have bigger issues in the first place (somebody with physical access to your machine's unencrypted data).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .