If the attacker is at the keyboard of your logged-in, not-screen-locked computer, you have definitely already lost. Regardless of the skill level of the attacker.
If this attacker is your friend, co-worker, spouse, room-mate or the like, your problem is social and not technical.
Those two points really should be obvious to everyone here. (This is a forum for software engineers, right?)
It is safer (and more honest) to provide no security mechanism where none can work, than to provide a fake mechanism and then claim that it can work. Perhaps people are so mentally abused by decades of security snake-oil (e.g. anti-virus products) that they have come to accept snake-oil as the pinnacle of security engineering. I don't know how else to explain what is going on in this thread...
Comments
If the attacker is at the keyboard of your logged-in, not-screen-locked computer, you have definitely already lost. Regardless of the skill level of the attacker.
If this attacker is your friend, co-worker, spouse, room-mate or the like, your problem is social and not technical.
Those two points really should be obvious to everyone here. (This is a forum for software engineers, right?)
It is safer (and more honest) to provide no security mechanism where none can work, than to provide a fake mechanism and then claim that it can work. Perhaps people are so mentally abused by decades of security snake-oil (e.g. anti-virus products) that they have come to accept snake-oil as the pinnacle of security engineering. I don't know how else to explain what is going on in this thread...