Question: How to stop a roommate from hacking your XP password?

[Destino]

A friend of mine asked me about this the other day and honestly I have no idea. My response would be "don't let him use your PC" but for reasons that escape me this isn't an option. I really don't know if the guy is using a keylogger or if he's simply bypassing it. He's certianly not changing the password because it's been changed several times but he claims that when he comes home his PC is logged onto his account... so it's being bypassed.

Anyone know of an additional security method?

[Chopper Dave]

Smith and Wesson?

[Special K]

Left hook...

[mistertim]

Tell your friend to look for something like this between the keyboard and where it plugs into the back of the PC.

http://www.thinkgeek.com/gadgets/security/c49f/

If it is a software keylogger then there are downloadable utilities that can detect them.

[.Guy.]

go into the bios and set a password to allow the computer to boot into windows.

[Special K]

By the way, did you ask your friend why the heck he doesn't confront his roommate about this?

[Enter Apotheosis]

Physical security + full disk encryption would pretty much guarantee that no one is going to be able to log on but who you allow on. It is also a major PITA.

[Ax]

Left hook...

Pretty sad when the ladies know the correct answer, and your friend doesn't.

[mistertim]

go into the bios and set a password to allow the computer to boot into windows.

That is a good idea. Didn't think about the bios passwords.

[Destino]

Pretty sad when the ladies know the correct answer, and your friend doesn't.

I think it's a family issue... personally my solution would be simple, don't touch my computer. My personal PC is off limits to anyone. My wife has her own.

[abdcskins]

Shoot him in the face. Ha I said that without even reading Chopper Dave's response.

*edit* Sorry drunk and bored. Not a good combo. Tell him to leave your goddam computer alone.

[twa]

Left hook...

Eh,if he is doing it after being told not to, it deserves at least a right hook.

Broken fingers might cut down on it:evilg:

[Veretax]

Another option would be to add encryption such as truecrypt to your system which would prompt for a password before it even boots into windows. I'm not sure whether this needs installed before windows though.

[zskins]

Another option would be to add encryption such as truecrypt to your system which would prompt for a password before it even boots into windows. I'm not sure whether this needs installed before windows though.

Encryption software is installed after Windows is installed.

As for the bypassing thing - is your friend absolutely sure he logged off his account? Because you can't bypass in Windows XP like you could in Windows 98 by pressing the cancel button.

Even if the roomie has a key logger on this pc he still need a pc to see what the password is and if he has access to this pc then why would he need to access someone else's account? And most AV software should prevent key-logger from being installed.

I think your friend needs to provide more details to properly help you.

[Burgold]

Open the back of the PC, remove the CPU, take it with you. Reinstall when you are at home.

[Rudechain]

go into the bios and set a password to allow the computer to boot into windows.

If it's a keystroker logger, then you still have not solved the issue.

The keystroke logger would simply pick up the Bios password. ( but setting a bios password is still a good idea)

Of course you can always remove the keyboard and only plug it in when you use it, but that is a hassle.

[DeanCollins]

just take the keyboard with you

[Kosher Ham]

just take the keyboard with you

Seems like he has a desktop.
A keyboard would slow them down, but not stop them.

My question is where is the computer located in the house ?

[Prosperity]

what about those finger print, or face scanning things?

[mistertim]

what about those finger print, or face scanning things?

A cool idea but not sure how economically feasible it is. Those sort of things tend to be rather expensive.

zskins made a good point about the keystroke logger. They can have self contained memory but you still need a computer to retrieve the data from it. If the roommate has access to another computer then what is the point? Unless said roommate has a specific reason for wanting to get into the friend's account. And that opens up a whole new can of "shady".

[GibbsFactor]

There's all kinds of ways one can get a password if they have physical or network access (just browse to the SAM directory and pull the files and you can run a decrypter on them to view all local account passwords including the admin file.

Best option is a power on password. But you have to keep your PC off.

If you are sharing network resources, encrypt the hard drive and turn off file sharing and access to C$.

[kubstix]

Open the back of the PC, remove the CPU, take it with you. Reinstall when you are at home.

Is this serious? Do you know that thermal compound would also have to applied every single time he puts the CPU back in? Anyways, if he's doing it by USB go into the Bios, password protect it, and disable the USB ports for a bit. If he installed a windows based keylogger than just password protect startup in the bios. A windows based keylogger doesn't start working until the computer is at the login screen for windows. The only way he could bypass your bios password and startup password is by removing the CMOS battery and if he is smart enough to figure things like that out, I doubt your going to keep him off the computer. Also, people don't realize the administrator password most likely has no password applied to it. If you hit CTRL+ALT+DEL twice at the login screen, you can manually log into the admin account which most likely does not have a password. I would also password protect that account just in case. Just a few easy options to think about.

[jnhay]

Maybe a USB token?
http://www.pcpartscollection.com/usbpclocktoken.html

There are ways to get around it, but hopefully the roommate doesn't know.

[HA1LV1CT0RY]

http://ecx.images-amazon.com/images/I/21aFG8RqbpL._SL500_AA250_.jpg

http://www.amazon.com/Eikon-Digital-Privacy-Manager-Fingerprint/dp/B0018E72TY/ref=dp_cp_ob_e_title_0

Finger print reader. You slide your finger across the scanner and if it matches the one you have previously set up it logs you on without having to type in a password.

This one is $43 but I have seen different brands go as low as $20.


UPEK's USB fingerprint readers provide quick and reliable biometric authentication to desktop or network resources. They include cost effective Eikon swipe readers for home or office use, or larger TouchChip readers for multi-user applications.UPEK's USB fingerprint readers use the same patented technology built into many of today's fingerprint-enabled notebook PCs, as well as many mobile phones, keyboards, POS terminals, door locks, handheld ID terminals and more.

[jnhay]

Why is this person using his roommate's computer anyway?


Maybe the roommate's doing this. Make sure your friend has a administrator password set.
http://www.mydigitallife.info/2006/11/25/easily-login-to-windows-xp-with-no-password-administrator-account-backdoor-trick/

[Destino]

I told him to go with a BIOS password. That was a good tip. I don't think his roommate is a hacker, just a loser that learned how to bypass XP via a google search (it's easy).

[Enter Apotheosis]

Finger print reader. You slide your finger across the scanner and if it matches the one you have previously set up it logs you on without having to type in a password.

This one is $43 but I have seen different brands go as low as $20.

Being able to log in without having to type in a password is no guarantee that your roommate can't log in using a password. Most of those types of fingerprint readers are quick, alternative means of authentication and not a replacement for keyboard log-ins.

[DCBnG21]

If someone has physical access to your PC the only way to stop them is a BIOS password and drive encryption. Fact is, Linux, Mac OSX and Windows all have fairly easy backdoors.

Practically speaking though, I think I would resort to the left (or right) hook in this situation. The guy is his roommate and he probably doesn't have anything on the computer necessitating drive encryption. Just tell him to stay the ******* off the computer.

[IONTOP]

What about leaving the computer on and installing a screensaver password? Also maybe setting it to a 1 min timeout while he's not there...

[ArmchairRedskin]

A punch in the taint
A lock on the door
A vicious guard dog
take the keyboard away

[frostyj]

Is there any evidence that he is on there snooping? Is it possible he didnt lock the machine? If it is on his account that is logged in then you can rule out the admin account and guest.

Set up a web cam with motion detection and see if he goes onto the pc or in the room.

[mbws]

Hack off his fingers.

[Skin'Em84]

take the keyboard with you...

[frostyj]

http://www.sowsoft.com/system-locker.htm

System Locker is a handy utility that allows you to protect your personal computer from unauthorized access. You can use System Locker to restrict access to your PC. It is attractive, secure, and very easy to use. It starts automatically with Windows and optionally locks your desktop upon loading. It hides your desktop on system lock and provides an informative message to other users. You can set start/stop times for users to limit their access.

Main features:
Secure mouse and keyboard input blocking
Powerful startup, automation and scheduling options
Audit and scheduling features
Resistance to brute-force password hacking
Sound support
Taskbar icon notification
Read more about System Locker

[mjah]

Bios password is a very good method. I successfully used one back in '94 against a hacker roommate who was using my machine all the time without my permission. He could have gotten around it but it was a sufficient PitA to keep him away. Since nothing is perfect, the goal is to make it too inconvenient/expensive/time consuming to be worth the roommate's time.