Open-ended question: Which is more secure, Windows or Linux?

The simpler a question appears, the harder it is to answer.

Before we analyze this issue in detail, perhaps we should first discuss the security policies and safeguards of Windows and Linux.

Windows

By default, Windows provides comprehensive protection for typical user scenarios. For example, its defense against physical intrusion is achieved through a combination of several technologies.

BitLocker is a classic full-disk encryption tool. It protects your data from being stolen. Even if a hacker steals your entire computer, they cannot access your data without the key. Moreover, it is enabled by default after logging into an account and is integrated into the Windows operating system, so no additional installation is required.

However, requiring users to enter the full BitLocker key every time they boot up their computer is clearly impractical. Therefore, Windows uses the TPM (Trusted Platform Module) to protect the BitLocker key. The TPM is a specialized hardware security module capable of securely storing keys.

The TPM is not located on the hard drive but rather on the motherboard or inside the CPU. It is very difficult to attack the TPM using software-based methods. The TPM can bind keys to specific hardware and software states. The TPM only releases the bound key when the system boots in an expected trusted state. This feature ensures that the key can only be used in a specific hardware and software environment.

During system startup, the TPM records the boot process, including the hash functions of the BIOS, bootloader, operating system kernel, and other critical components. These hash functions are stored in specific registers within the TPM, known as Platform Configuration Registers (PCRs). Through this mechanism, the TPM can ensure that the system's boot environment has not been tampered with. As a result, ordinary users simply need to turn on the power to automatically unlock the hard drive and enter the operating system, without having to enter the BitLocker key.

https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices#what-happens-when-pcr-banks-are-switched

Of course, relying solely on TPM technology to protect BitLocker is far from sufficient. If an attacker can physically attack your computer—for example, by tampering with the firmware of a facial recognition camera—they could bypass login verification by modifying the camera's firmware without altering the TPM keys.

Therefore, Windows also features a technology called Secure Boot. Secure Boot is a UEFI-based technology that ensures only operating systems and drivers signed by Microsoft or hardware manufacturers are loaded during system startup. If an attacker corrupts the system bootloader or the operating system kernel, Secure Boot will refuse to start the system.

In real-world scenarios, even if the theoretical design is highly secure, security risks can still arise from user errors, such as writing important passwords directly on paper or entering passwords while being recorded by a camera. To enhance practical security and reduce the attack surface, the use of biometric authentication can sometimes be more important than theoretical safeguards.

To make logging in convenient for users, avoiding the hassle of typing passwords or making mistakes, Windows also supports Windows Hello. Windows Hello is a biometric technology that verifies user identity using methods such as facial recognition, fingerprint recognition, and iris scanning.

Of course, Windows itself also goes to great lengths to prevent malicious tampering by hackers. Since Windows Vista, User Account Control (UAC) has been introduced. UAC ensures that users must provide secondary confirmation when performing sensitive operations. This prevents users from unknowingly granting higher-level privileges to malicious software.

At the same time, Windows introduced code integrity checks based on digital signatures starting with Windows Vista. This feature ensures that only digitally signed code can be loaded during system startup. This prevents malicious software from being loaded into memory at system boot. If hackers or malicious software attempt to tamper with system files, Windows will refuse to start. Additionally, system files can be repaired using the sfc /scannow command.

Windows security policies offer more than just these features for ordinary users. For example, starting with Windows 10, Windows Defender antivirus software is enabled by default. It monitors process behavior in real-time and can immediately block suspicious activities. Windows Firewall is also very powerful; it provides excellent protection while causing minimal disruption to daily use for most users.

I recall that some time after the release of Windows 10, Windows introduced a very interesting feature called Virtualization Based Security. This technology uses Hypervisor hardware-assisted virtualization to run the operating system kernel and user-mode applications on different virtual hardware. This feature thoroughly prevents any potential malicious software from accessing kernel-mode memory addresses.

Windows' update strategy is also very simple: all updates come from Microsoft's sole distribution channel, and the code is written entirely by Microsoft engineers. This ensures that all code running on a user's Windows system is developed by Microsoft engineers, preventing any possibility of malicious code being mixed in.

Back in the Windows XP era, many users set themselves as administrators, granting all programs administrative privileges. System files could be tampered with at will, and even an ordinary process could freely modify system memory. Security back then was so low that simply browsing a few websites could lead to a hacker taking complete control of the computer, or even the bizarre phenomenon of hundreds of viruses infecting the system simultaneously, "nurturing" each other in a digital petri dish. Of course, today, with Windows having security features enabled by default, it has become extremely difficult for hackers to read, tamper with, or spoof information on a computer, even if they have physical access to it.

In other words, for the security of ordinary users, Windows does not rely on one or two specific technologies, nor is it a problem that can be solved by just a few software tools. It is an entire ecosystem, providing full-chain protection from hardware to software, from firmware to the operating system, and from detection to interception. These technologies include, but are not limited to:

• Kernel DMA Protection
• Virtualization Based Security
• Code Integrity Policy Enforcement
• TPM
• UEFI
• Secure Boot
• Modern Standby
• BitLocker
• Device Encryption
• Windows Recovery Environment
• UAC
• Windows Defender
• Windows Firewall
• Windows Update
• Windows Hello

(The image above is sourced from Safe-Windows)

This closed loop ensures the security of Windows. (This is not because I am a Microsoft employee that I praise Windows' security; in fact, for an ordinary user, the security of Windows is very high based on the protections mentioned above.)

Linux

For an ordinary user, if we draw an analogy to the comparison process described above, we would find that:

Linux also has a full-disk encryption tool called LUKS2, which can also protect your data from being stolen. Even if a hacker steals your entire computer, they still cannot access your data without the key. However, this protection is generally not enabled by default.

Of course, enabling LUKS2 likely means you will need to enter a password every time you boot your computer. Naturally, you can also use TPM to protect the LUKS key in Linux, which is similar to the strategy used in Windows. TPM ensures that the key can only be used in a specific hardware and software environment, and it verifies that the system's boot environment has not been tampered with by recording hash values during the boot process.

In the Linux world, Secure Boot is not very popular. In fact, I have seen many people disable Secure Boot as the very first step before installing an operating system. This is because Secure Boot restricts users from installing unofficial operating systems and drivers. This is very unfriendly for Linux users. As an operating system that strongly encourages freedom and modification, Linux actually does not favor integrity protection of code.

Strictly speaking, Secure Boot is fully achievable in Linux. Many distributions support Secure Boot by default, such as Ubuntu and Fedora. These distributions ensure that only operating systems and drivers with trusted signatures are loaded during boot.

(The image above is sourced from https://www.youtube.com/watch?app=desktop&v=SQ7Ajv2Cnzg )

Biometric authentication support on Linux is also gradually improving. Although it is not integrated into the system as seamlessly as Windows Hello, users can implement similar biometric features on Linux through some open-source projects, such as fprintd (for fingerprint recognition) and howdy (for face recognition). (Of course, this does not solve the issue of a hacker gaining control of the camera)

Regarding user permission control, Linux also has mechanisms similar to UAC, such as the sudo command, which ensures that users must enter an administrator password to confirm sensitive operations. This helps prevent users from being exploited by malware without their knowledge. However, unlike Windows UAC, which displays prompts on a secure desktop, sudo does not have the concept of a secure desktop. Additionally, many users configure their systems to allow sudo without requiring a password.

For Linux users, security often comes at the cost of convenience, requiring frequent password entry.

Linux systems typically do not come with integrated antivirus software, but there are open-source antivirus tools, such as ClamAV, that can be used to scan for and remove viruses. However, due to the secure design of the Linux system, the widespread use of package management systems, and the relatively lower adoption rate of Linux among the general user base, the risk of Linux systems suffering from virus attacks is relatively low.

Linux firewalls include popular options like iptables and nftables, which can be used to configure network rules and restrict network access. Of course, this requires users to have a very clear understanding of what they are doing. If a user is frustrated enough, they might even go as far as disabling all firewall rules.

As for VBS, there are almost no direct equivalents in the Linux world (perhaps Heki-Linux). The only alternative might be KVM, where critical business operations are run in a virtual machine to ensure security. However, I believe ordinary users would never do this.

Unlike Windows, Linux updates and software distribution are typically handled through the package management systems of various distributions, such as apt, yum, and dnf. In most cases, Linux users install and update software from official repositories, which are usually maintained by the distribution's development teams to ensure software security. However, there have been numerous historical incidents where contributors have introduced malicious code into open-source repositories, with SSH being a particularly common target. Almost every year, a 0day vulnerability is discovered.

A free operating system also offers new advantages: the code is public, allowing users worldwide to review it, making it very easy to find backdoors. This is highly beneficial for privacy and security protection. Users can also deeply customize, modify, and trim their operating systems according to their needs, which helps reduce the system's attack surface.

Initial Comparison

After hearing me say that, doesn't it feel like Windows' security completely crushes Linux? Whether in hardware or software, Microsoft has established a complete chain of trust, ensuring that every link from hardware to software is trusted and verified. Linux, on the other hand, due to its open-source nature, ensures code transparency but also means that anything can run—so anything, including hackers' code, could potentially run.

However, in my comparison above, I have consistently included a hidden condition: the ordinary user. In fact, before even starting to answer this question, I never truly defined what "security" means.

This is why it is an open-ended question. There will never be a standard answer; it is a matter of perspective, where different people see different things. For example, some people install Windows solely to play PUBG. They might not even care whether their system is secure. They may disable VBS to improve frame rates, buy gaming PCs that do not include firmware integrity checks or DMA protection, turn off BitLocker to boost disk performance, or even use the Administrator account to play games. They have likely disabled all security features. Are they really in danger?

I don't think so. Whether you are in danger depends on the cost of a hacker attack against you. If this is just a gaming PC, the maximum damage a hacker can cause is probably stealing your account. Since PUBG is a free game and your account is not linked to any bank card information, what loss would a hacker stealing your account actually cause you?

So in this scenario, which is more secure, Windows or Linux? The answer is likely: I don't care.

When we discuss information security, we must have specific scenarios, specific threats to defend against, and specific incidents to avoid.

Rethinking This Problem

Reconsider the question above. For ordinary home users, if we only discuss the probability of a hacker stealing a computer and extracting data from the user directory, Windows is undoubtedly significantly more secure. It enables numerous security features by default, and these features are almost transparent to regular users.

The issue is that many Windows users are not ordinary home users but rather "users who believe they are professional but actually are not." They assume they do not need protection and thus disable a large number of security features, such as BitLocker, VBS, UAC, the firewall, Windows Hello, and Windows Defender, to gain better performance. However, they may overlook the aspects of their system that could be targeted by attacks. For example, if a computer is stolen by a hacker, they could steal browser Cookie files, remotely log into accounts, take control of live streaming rooms, and play cryptocurrency advertisements, among other things. These incidents have actually occurred multiple times in the past.

(Image source: https://www.youtube.com/watch?app=desktop&v=CB7m8-VMKzw )

However, why do many developers and servers still choose Linux? The main reason is that for someone who knows how to defend themselves, the high customizability of Linux actually provides a very high ceiling for development. You can still use LUKS2, sign your own kernel, and have Secure Boot trust your own digital certificate. You can manually audit code and deploy only software you trust. You can also configure dm-verify to implement integrity checks. You can find biometric authentication scripts to implement fingerprint recognition for unlocking root privileges. There are also fewer viruses on Linux, so you do not need to be as afraid of viruses. You can also deeply understand how package management works, build whitelisted software repositories, and construct zero-trust firewalls…

This is why this is an open-ended question. Because security is not an absolute concept, but a context-dependent one. Security depends on your needs, your usage scenarios, your adversaries, and your technical level.

So, which is more secure, Windows or Linux? The answer to this question is: it depends on you.