Home / ubuntu / Questions / 74463
Accepted
Dustin
Asked: 2011-11-02 08:56:26 +0800 CST

No user name/password required when exploring from live USB? [duplicate]

  • 772

A few months back when I buggered up my netbook and then booted into it to get information from it using a live USB. (Thinking that was 10.10)

When I was copy/pasting this to another USB at no time was I required to enter my user name or password to access this information. Why and how was that possible? Shouldn't that not be possible? This was information from the 'home' including documents, pictures, music, videos and some other locations.

This does not sound secure at all, is there any way that I can ensure this cannot happen again and that user name and password would be required to access information on my installed Ubuntu computer when booting on that computer from a live USB/CD/DVD?

permissions

2 Answers

  1. This is possible because your files are on the hard disk, so anyone with full control over whatever operating system is running on the computer has full control (including full access) to your files. This is the case when running Ubuntu or another OS from a live system (live CD/DVD or live USB), and this is also the case if someone were to take the hard drive out of your computer and put it in their computer.

    You can get a reasonable degree of protection from this by encrypting your home folder, making sure to only store your files in your home folder (of course back them up somewhere else besides this computer, though...and make sure the backup is secure), and using a very strong password. The password is stored, encrypted, on the hard disk, so if it's weak, the encryption can be cracked pretty easily. See this comic for a relatively accessible explanation of some of the issues relevant to password choice.

    Encrypting your home folder is an option during installation, but you can also enable it on an already-installed system by following the instructions in this guide. It is recommended to encrypt your swap partition too, which that guide also explains.

    The reason most users do not encrypt their home folders (besides not knowing that it is an option or not being extremely concerned about the privacy of their data) is that, often, the person trying to access your files without your password is you. This also complicates (but does not usually prevent) recovering data from the disk, even if it is mostly intact and you remember the password.

    If you want to increase your protection, make sure the password you use for your Ubuntu system is not the same as or even similar to the password you use for anything else, such as any websites.

    • 2
  2. Best Answer

    No user name/password required when exploring from live USB

    Why and how was that possible? Shouldn't that not be possible?

    Well, you are using the OS (Ubuntu) from the live USB not OS from your installation

    This does not sound secure at all, is there any way that I can ensure this cannot happen again and that user name and password would be required to access information on my installed Ubuntu computer when booting on that computer from a live USB

    You could encrypt you data:

    https://help.ubuntu.com/community/EncryptedFilesystems

    https://wiki.archlinux.org/index.php/System_Encryption_with_LUKS

    Why Use Encryption?

    In the simplest terms encryption is a method for establishing privacy.

    • 2