This is in line with the way most operating systems work nowadays, and, while it may cause a few issues where software (and documentation) assumes the existence of the “pi” user, it feels like a sensible change to make at this point. So with this latest release, the default “pi” user is being removed, and instead you will create a user the first time you boot a newly-flashed Raspberry Pi OS image. But nonetheless, it could potentially make a brute-force attack slightly easier, and in response to this, some countries are now introducing legislation to forbid any Internet-connected device from having default login credentials. This isn’t that much of a weakness – just knowing a valid user name doesn’t really help much if someone wants to hack into your system they would also need to know your password, and you’d need to have enabled some form of remote access in the first place. Up until now, all installs of Raspberry Pi OS have had a default user called “pi”. There is always a balance to be struck, however, as security improvements usually carry a cost in terms of usability, and we have tried to keep the system as convenient to use as possible, while having an acceptable level of security. Over the years, we have gradually ramped up the security of Raspberry Pi OS not in response to particular threats, but more as a general precaution. Cyber-attacks and hacking are, sadly, constantly on the increase, and Raspberry Pi computers are as much a target as any other, just because there are so many of them out there nowadays! One of the things which we spend a lot of time thinking about here at Raspberry Pi is security.

Raspberry pi zero w headless setup