Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I set my Windows 7 account to automatically logon so I don't have to type a password, and I don't have to click my username on the logon screen, I heard it's a security risk.

From Windows 7 Auto Login:

Although I don’t personally recommend this, there are some people out there who don’t want to bother with using a password to protect their Windows user account. Of course, using a password in Windows isn’t required, only suggested. But even if you don’t fill one in, you still have to click your user icon to start the login process.

An easier way - although again much less secure - is to enable auto-logins for your Windows PC. This is possible in Windows 7, as it was in prior versions, but it takes a little finagling to do so. (And for good reason, darn it.)

What is risky about it besides people being able to logon locally? Does it make it easier for hackers to logon remoately?

share|improve this question
6  
This is sort of like asking 'what's the risk of jay-walking besides being flattened by a motor vehicle?' –  pavium Nov 30 '09 at 4:10
    
No, it's like asking "what are the risks of jay-walking besides other cars." –  Phenom Nov 30 '09 at 9:38

3 Answers 3

up vote 9 down vote accepted

That's the security risk it is referring to - anyone who obtains physical access to the machine is able to log on and access any of your data. If your computer is in a safe place and that isn't an issue for you, there's no need to worry about it!

share|improve this answer
5  
Technically, if someone had physical access to your computer and they really wanted your data, they could get it without knowing your password. But by that time you have bigger things to worry about. –  Sasha Chedygov Nov 30 '09 at 4:10
1  
Sure they can get my data and all, doesn't mean they will be able to read any of it. Encryption is king. –  John T Nov 30 '09 at 4:19
    
If it's encrypted, then it's a different issue (since they still need a password, they just put it in earlier). –  Brendan Long Nov 30 '09 at 7:20
    
My point was that if a complete stranger has physical access to your computer, your password is the thing you should be least worried about. ;) –  Sasha Chedygov Dec 24 '09 at 7:18

No, remote hackers won't be able to do anything more than they otherwise could. The risk is only local, as you already mentioned.

If your computer is on your desk at home and you know who is around, then use autologin.

If it's a laptop and/or work computer then don't use autologin.

share|improve this answer

Aside from the obvious risk that someone can walk up to your computer and use it, there is another minor security risk. When you set autologon, your password is now on the computer. It is encrypted and theoretically safe, but there's always a chance that it can be discovered.

share|improve this answer
    
The password is already on the computer. If it wasn't, the computer wouldn't be able to check if it's correct. I assumed Windows just had an "auto-login" flag, but I guess having an unencrypted file with the password in it would work too.. :-\ –  Brendan Long Nov 30 '09 at 7:23
    
@Brendan Long: There are ways to store a "password" on a computer so that it can not be recovered without brute-force attacking it. This is different from the ways that, say, your browser stores passwords for your favourite websites, where the cleartext of the password is needed. –  Mr. Shiny and New 安宇 Nov 30 '09 at 14:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.