Is autologin on Ubuntu more/less dangerous than autologin on Windows?

Question

I have autologin on Windows - I hit the power button and the computer boots up to the desktop without prompting for a password.

I'm setting up an Ubuntu machine to do the same thing by setting a blank password for the keyring password manager.

What I'm wondering is, do both machines have the same chance of being hacked or is it easier to hack into an Ubuntu machine?

Because, as far as I know, I have never had a problem on Windows because of autologin.

I'm just trying to determine, based on my experience, whether it's more or less safe to do this on Ubuntu.

The only difference between the machines besides that is that I have Zone Alarm Security Suite on my Windows machine - this has a pretty good firewall, so maybe I should even my odds by installing firestarter on Ubuntu?

Summary:

1. Is autologin less safe on Ubuntu than on Windows
2. Would a software firewall (firestarter) make it less unsafe to use autologin on Ubuntu?

Answer 1

Local hacking,

same risk of someone coming up and turning on... Maybe (if lucky) less damage on Ubuntu as some people may not know how to do damage!... but that would just be luck.

Over network,

On Windows, just because you enable the logon without asking for credentials option (providing you did it this way), is not the same as having a blank password.

I would of thought that the Ubuntu box should have some security against blank passwords, but you better be careful if installing any sort of remote administrator tool that could allow people to connect without authenticating.

Rather than not setting a password, I would take a look and see if there is some option such as in Windows where you can just set it to auto login you in.

Answer 2

In Ubuntu one still needs your password to sudo anything, so harm is more limited, whether local or remote.

Answer 3

In my experience, autologin on Ubuntu is actually a bit safer than Windows as linux machines, by default, are closed to the internet until ports are specifically opened up by your programs. You don't have to set a blank password, Ubuntu supports autologin with accounts that have passwords. I would suggest, however, that you find out how to lock your computer on both Windows and Ubuntu via script, and add those scripts to your start up items. This way, you can have the computer start up, log in, and have it protected from casual walk by attacks (which would include someone breaking into your home, stealing your computer, and taking it somewhere else). Not trying to scare you here, just the way I work with my own computer's security.

Also, Firestarter will help against external attacks from the internet, and is a good idea in general, but isn't really needed for autologin protection.