It is in fact an simple change to UMASK in /etc/login.defs. The default value is different between various Linux distributions and in fact Unix systems as a who

It is in fact an simple change to UMASK in /etc/login.defs. The default value is different between various Linux distributions and in fact Unix systems as a whole depending on the "pedigree". On the multiuser systems the default tends to be 022 (ie. 755 permission bits => read and execute to everyone), on "internet server" systems 033 (ie. execute to everyone, such that finger and http://foo.bar/~quux/ http://foo.bar/~quux/ works) and 077 on workstation unix systems (ie. $HOME is completely private). And I have strong feeling that the whole story about "systems shared by family" is just PR spin as that setting is simply default in upstream Debian...