98

It's common knowledge that if somebody has physical access to your machine they can do whatever they want with it1.

So why do we always lock our computers? If somebody has physical access to my computer, it doesn't really matter if it's locked or not. They can either boot a live CD and reset my password or read my files (if it's not encrypted), or perform a cold boot attack to get my encryption keys from memory (if it is encrypted).

What's the point of locking a computer besides keeping the average coworker from messing with your stuff? Does it provide any real security benefit, or is it just a convenience to deter untrained people?

1. unless the computer has been off for a while and you're using full-disk encryption

Tom Marthenal
  • 3,272
  • 4
  • 22
  • 26
  • 31
    Prevents casual fiddling. Network resources aren't available unless you have access to the account on the DC so the boot disk gets you nowhere. One of our company's worst kerfluffles was when an office manager got in the habit of leaving her computer in payroll and one of the clerks decided to use that information. Being in the habit of locking would have prevented the issue, or not leaving the program up in that window, etc. While your premise is correct, it is overthinking around the real reason locking or logging out is used. – Fiasco Labs Oct 22 '12 at 00:18
  • 46
    Actually, the complete phrase is "they can do whatever they want with it *given enough time*". Also, by the same token in *theory* anyone can pick a cylinder or tumbler lock, *most* people don't have the equipment/practice to do it with them on a daily basis. – Shadur Oct 22 '12 at 09:15
  • 5
    Most of the answers seem to be about locking the screen, but the question has the physical tag. So I would assume the question is about physically locking up the computer itself. What do you mean locking the computer? – emory Oct 22 '12 at 13:07
  • 2
    @emory has a good point. Tom, what are you asking about here? Everyone seems to have assumed it's about locking the session or logging out of the computer. Are you asking about that, or are you asking about physically securing the computer case from intrusion? – Iszi Oct 22 '12 at 13:43
  • 9
    Keep in mind that loss of data isn't the only risk here... Any actions performed from your session look like they were done by you. And not locking your screen could be considered negligence. You've left your front door wide open and courts may not look in your favor in cases like this. – Micah Henning Oct 22 '12 at 15:37
  • 5
    @emory, the question was indeed about locking a screen. The physical tag was used because an unlocked computer is still a physical problem (i.e. physical access is the problem). Sorry for the confusion! – Tom Marthenal Oct 22 '12 at 15:56
  • 4
    I used to prank my co-workers whenever they didn't lock their machines: my favorite was replacing their desktop with a screenshot of their desktop and then hiding the icons; I got that process down to 25 seconds flat. :-p – David Murdoch Oct 22 '12 at 19:35
  • 3
    why do we lock our cars if anyone can steal them anyway? why do we lock our doors in our apartments? what is it exactly that you want to know? – Alex Gordon Oct 22 '12 at 20:30
  • 1
    Since reading this question, I don't bother to lock my door at night anymore. I mean, if someone wanted to enter they could simply cut a hole in the door and walk through, so there's no point in locking it really! – wim Oct 23 '12 at 06:18
  • Why do you lock your house Before going out? – Vishwanath Dalvi Oct 23 '12 at 11:28
  • 4
    I mainly lock my computer when the cleaning woman comes, otherwise she bangs my keyboard and mouse with her cleaning tools and leaves keystrokes and mouse clicks all over the place. The first time it happened I had to clean up her "work" in my code editor. – Kevin Rubin Oct 23 '12 at 13:29
  • 1
    @KevinRubin Haha! I have also the similar problem with cat walking on the keyboard .. – wim Oct 24 '12 at 00:41

13 Answers13

123

In some places they have a saying: "opportunity makes the thief". All you're doing by screen-locking a computer is making the cost of hacking it just a little bit harder.

Security is an economic good, with a price and a value. The value of locking is somewhat larger than the price of locking it. Sort of like how in good neighborhoods, you don't need to lock your front door. In most neighborhoods, you do lock your front door, but anyone with a hammer, a large rock or a brick could get in through the windows. In some neighborhoods, not only do you lock the door, you have a solid-core door with a deadbolt, and you have steel gratings over the windows. In the best neighborhoods, the value of the steel gratings isn't worth the price, but in bad neighborhoods, the value does exceed the price.

a cat
  • 113
  • 1
  • 7
Bruce Ediger
  • 4,552
  • 2
  • 25
  • 26
  • 10
    The saying I've heard is that locks keeps honest people honest but it's the same premise. – Michael Brown Oct 22 '12 at 14:32
  • 2
    Heavy security also attracts criminality, because where there is heavy security, there is something to hide. – gerrit Oct 22 '12 at 16:08
  • 7
    "Good fences makes Good neighbors" - [Mending Wall](http://en.wikipedia.org/wiki/Mending_Wall), **Robert Frost** – Mark Rogers Oct 22 '12 at 16:23
  • 3
    @gerrit perhaps you are right. Could you provide your residential address so I can verify you have nothing to hide? – emory Oct 22 '12 at 17:26
  • 1
    @emory My point is about not drawing attention. – gerrit Oct 22 '12 at 20:02
  • @gerrit What draws attention is being different. Most people lock their computers, so a computer which is locked does not particularly draw attention. A computer which is unlocked, on the other end... – Sylverdrag Oct 24 '12 at 13:14
  • @Sylverdrag true. I was thinking of the analogy of a full street where most houses have ordinary protection, but one house is very heavily guarded. That would make people expect there is something to get there. – gerrit Oct 24 '12 at 13:39
58

It's a risk management thing, really. An attacker with a short window of opportunity (e.g. whilst you're out getting coffee) must be prevented at minimum cost to you as a user, in such a way that makes it non-trivial to bypass under tight time constraints.

Hitting WinKey+L or clicking the lock button is next-to-zero cost for you as a user. Taking the time to reboot the machine, load up a live CD and extract the data (e.g. documents, SAM database, etc.) is not a short process - it's at least a 10 minute job and the reboot alerts you to a potential problem. The cost for the attacker is significantly greater than the cost for the user.

It's also a great way to prevent the casual attacker - e.g. the journalist you leave in your office for 5 minutes whilst you take a work call. If they see your computer unlocked, with all its data immediately available, they may take the opportunity. If they see that it's locked, they won't bother. 99% of visitors do not come equipped with data exfiltration equipment!

Polynomial
  • 132,208
  • 43
  • 298
  • 379
  • 8
    Hitting WinKey+L or clicking the lock button is next-to-zero cost for you as a user. ... I disagree... the real cost is having to type your password again to get in... not a huge cost but not next-to-zero either – SplashHit Oct 22 '12 at 16:08
  • 1
    I guess my experience has been tainted by always having a biometric device available, which takes less than a second to use. – Polynomial Oct 22 '12 at 16:23
  • 4
    @SplashHit It is a next-to-zero cost compared to other security measures, such as having a encrypted dongle required to gain access to the system. Perhaps over the course of a significantly long period of time, the time lost to typing in a secure password versus having a physical object unlock the system would justify the initially costlier system, but it's not an issue for most computer users. –  Oct 23 '12 at 01:42
  • 2
    @Polynomial The funny thing is that most of those are actually way easier to crack than a password. One could get your fingerprints anywhere without you even knowing. A password can only be obtained by physical access to you, a blowtorch and some pliers. – TC1 Oct 23 '12 at 10:10
  • @TC1 I'm aware of the reduction in security. It's for convenience, not security. – Polynomial Oct 23 '12 at 10:13
  • 1
    @TC1 or a post-it next to the keyboard.. – Thomas Oct 23 '12 at 13:07
  • 1
    The idea is that today, at least in my case, if someone ill intentioned would have acces to my email and send something insulting to one of my superiors it would be hard and embarassing for me to explain that it wasn't me who send that email.I also use my computer for typewriting math, and that is not very fast. If someone would erase my source files, all that work would be lost. I'm not saying that all the people are bad, but it really is no big deal to lock your computer when you don't use it. – Beni Bogosel Oct 23 '12 at 14:05
  • 1
    @BeniBogosel You want to say that you don't do backups?? Really? – Display Name Feb 07 '14 at 01:47
  • 1
    @SargeBorsch: What in my message told you I don't do backups? I hold everything important to me in cloud. Still, I wouldn't like someone messing with my files. That was the main point in my comment. – Beni Bogosel Feb 07 '14 at 12:50
26

Locking your computer prevents surreptitious snooping or alteration. If you don't lock, it is easy for someone to poke around inside your session in such a way that you will not notice it when you return to your machine.

The security benefit is real because there is a class of attacker who wants access without leaving any trace whatsoever. For that class of attacker, rebooting your machine and messing with your password are not options, unless that attacker is confident that he or she can restore your computer to very closely resemble the state in which you left it.

It is one thing for security to be compromised, and another for it to be compromised without a trace.

There is an analogy there with physical security. If you don't lock your doors and windows, then a thief can enter your house without leaving any trace of entry. The thief can steal something such that you do not even notice that it's missing until much later, perhaps months, if not years. One day it occurs to you, "Don't I own such and such a thing? Now where is it?" then waste time looking for something that, unbeknownst to you, was stolen long ago. Insurance people call this situation "mysterious disappearance".

If a thief does enter, it is better if there is evidence of forced entry.

Kaz
  • 2,303
  • 16
  • 17
  • 8
    In-line with the part about locking a house, few bystanders would question someone walking up to a house and entering through the front door. The assumption is that the person entering it has a reason to. If a bystander watches someone break into a window, they're much more likely to call the authorities. This is analogous with sitting down at a computer that's unlocked, vs physically hacking into the system after crawling under a desk. – zzzzBov Oct 22 '12 at 17:44
25

"What's the point of locking a computer besides keeping the average coworker from messing with your stuff?"

By protecting your self from average coworker you've protected your self from largest subset of people who'd want to find something personal about you or do you harm.

enedene
  • 483
  • 1
  • 4
  • 8
12

In most environments where it is necessary to lock your computer, what you are protecting isn't on your computer, but on networked computers which you have access to through your credentials. So a quick boot using a CD doesn't directly give the attacker anything useful, it is just a single step. While you are right that ultimately this isn't a barrier to a determinined attacker, it is a barrier to a an opportunistic hacker.

Think of a bank teller computer -- if you are making a deposit and they were to walk away at the point of confirming your deposit amount it would be easy to go ahead and complete the transaction with 10,000 instead of 10 dollars. If the computer is locked, even after they reboot, they won't have the same access.

jmoreno
  • 496
  • 2
  • 9
10

In addition to all the other answers, think about skill. If I come across an unattended, unlocked laptop, it takes no particular skill to send an email from that computer to the Company President; that email can range from prank to criminal activity. The other attacks you describe require a bit more skill.

Reinforcing what others have said, security is risk management. We need to compare work factor to deploy the control to the impact it has on the adversary's work factor. Locking the computer is very low work factor, but forces the attacker into an attack script that requires more time and skill.

MCW
  • 2,572
  • 1
  • 15
  • 26
10
  1. It takes time to boot to a live CD
  2. Modifying the hardware will attract attention whilst simply using someone else's PC won't
  3. More people will attempt to use an unlocked PC then a locked one in the same way you're more likely to have your bike stolen without a bike lock than with an unlocked bike lock on it.
Inverted Llama
  • 553
  • 2
  • 10
10

Security is not only about the document located on your computer. Without a proper authentication to the company, someone having access to your machine should not have access to your emails (unless stored locally) and can't access network resources with your name.

When we say that having physical access is like losing this machine, it also implies that the attacker have time to act. If the attacker does not have time, he can't possibly boot an offline password breaker to change your password, access your data and getting what he wants. Furthermore, the process is destructive and alarm will be given as soon as you find your account has been accessed.

An other scenario would be if the attacker want to get something that is not stored on the computer, for example your password for a given application (corporate or private). Physically breaking in is not an option, as he wants to remain stealth. Howerver, if you provide the attacker with a sufficient window of time to install a keylogger.

In term of risk, it is also more probable that someone will attack your unlocked session, rather to steal or break physically your machine. Thus, it is a good measure to lock your session whenever you leave your office/desk.

M'vy
  • 13,033
  • 3
  • 47
  • 69
8

You can't ever make something completely secure and still make it accessible. Therefore, you can't ever prevent anyone from gaining access to your computer system. All you can do is make it harder for them to gain access. And in the case of locking your screen, a simple two-second stroke of the fingers can bring great inconvenience to someone wanting access. You effectively, exponentially increase the skill, cleverness, and knowledge required to gain that access.

Micah Henning
  • 181
  • 3
6

I'm no security expert by any stretch - but this really just seems like common sense. The average criminal isn't an Eastern-bloc spy; they just want to pick the low-hanging fruit from a tree in someone else's yard. If you lock it up, you push the fruit to a higher branch.

AviD
  • 72,138
  • 22
  • 136
  • 218
  • 2
    I'm not quite sure how the video is relevant at all. It has little to do with locking the computer in any sense. – Iszi Oct 22 '12 at 13:45
  • His computer and external hard drives were stolen because, as the host stated, he didn't properly secure his own home from burglary. –  Oct 22 '12 at 15:40
  • A fair enough point, I suppose. However, the clarification given by the OP - that this question is about locking the computer session, not physically securing the environment - renders the video entirely irrelevant. – Iszi Oct 22 '12 at 17:05
  • Well, thank you for the clarification. But, nonetheless, in the video, he also failed to lock and encrypt his computer, thus allowing the burglar to (assuming it was the perp in the video) to use it for himself, or fence it. –  Oct 22 '12 at 22:18
  • Thank you for the clarification. But, nonetheless, in the video, he also failed to lock and encrypt his computer, causing data compromise. Of course, that ended up helping him get his computer back. But regardless, locking the computer and encrypting his files would have been fair preferable - a moronic burglar would not have the skills (or inclination to acquire them) to circumvent disk encryption, and have had no choice but to reformat. But hey, who am I tell people what to do? If people don't want to lock their session, then more power to them. (Sorry, I hit enter by mistake before) –  Oct 22 '12 at 22:26
  • Locking the workstation (or not locking it), as I recall, had *nothing* to do with the compromise in the scenario from that video. The difference between the video and the question here is that the question here is about locking a workstation in a scenario where the attacker has time-limited physical access and presumably would rather not leave obvious traces behind. In the scenario from the video, there was *unrestricted* physical access and no worries about computer forensic evidence since the system would never be returned to its owner. – Iszi Oct 23 '12 at 00:59
  • In the scenario in the video, locking the live session provides effectively *zero* security benefit without whole-disk encryption (a completely different solution for a completely different problem). For the scenario in question here, it presents a significant increase in the time required and potential trail left by a successful hack which therefore greatly increases the chances of being caught. – Iszi Oct 23 '12 at 01:02
  • You all coerced this guy into yanking his movie? I guess I don't need popcorn anymore... – Shawn Eary Sep 06 '22 at 15:32
5

Locking the workstation impedes anyone's attempt to accidentally peek into your documents, email or pictures. There is a difference between locking and making something hackproof!

AviD
  • 72,138
  • 22
  • 136
  • 218
Umair
  • 151
  • 2
4

Another commonly omitted aspect of locking your computer is dismissing others from liability. The principle is similar to why you avoid leaving your password written on a piece of paper on your desk. By not doing that you're not only protecting your privacy but you are also protecting others from getting accused of knowing it. Because you reduce the probability of that happening significantly.

Their intent doesn't have to be malicious either. Someone's computer might be broken and yours could be the only computer unlocked, so he could assume that as "available" and do his work on your machine and accidentally destroy all your work. Locking your computer saves them from the responsibility.

Of course a computer can be breached even when locked by advanced users similar to how someone can guess your password by just trying your cat's name. By locking your computer, however, you change the odds in both your and your colleagues'/roommates' favor.

Sedat Kapanoglu
  • 721
  • 3
  • 16
3

Usually other people in your office are annoying gits - it doesn't always matter about security, it may just be something annoying - changing a wallpaper or similar!

... just see this for ideas - https://superuser.com/questions/275894/how-to-mess-up-a-pc-running-windows-7

Community
  • 1
wilhil
  • 161
  • 1
  • 5