Jump to content
  • Windows 11 now warns when typing your password in Notepad, websites


    Karlston

    • 550 views
    • 4 minutes
     Share


    • 550 views
    • 4 minutes

    Windows 11 22H2 was just released, and with it comes a new security feature called Enhanced Phishing Protection that warns users when they enter their Windows password in insecure applications or on websites.

     

    Windows login credentials are valuable to threat actors as they allow them to access internal corporate networks for data theft or ransomware attacks.

     

    These passwords are commonly acquired through phishing attacks or by users saving their passwords in insecure applications, such as word processors, text editors, and spreadsheets.

     

    In some cases, simply typing your password in a phishing login form, and not submitting them, is enough for them to be stolen by threat actors.

     

    To combat this behavior, Microsoft introduced a new feature called 'Enhanced Phishing Protection' that warns users when they enter their Windows password on a website or enter it into an insecure application.

     

    "SmartScreen identifies and protects against corporate password entry on reported phishing sites or apps connecting to phishing sites, password reuse on any app or site, and passwords typed into Notepad, Wordpad, or Microsoft 365 apps," explains Microsoft Security Product Manager Sinclaire Hamilton.

     

    "IT admins can configure for which scenarios end users see warnings through CSP/MDM or Group Policy."

     

    This new feature is only available in Windows 11 22H2 at this time, and it is not enabled by default. It also requires you to log into Windows with your Windows password rather than use Windows Hello.

     

    So if you use a PIN to log in to Windows, this feature will not work.

     

    When enabled, Microsoft will detect when you enter your Windows password and then issue a warning prompting you to remove the password from an insecure file or, if entered on a site, to change your Windows password.

     

    password-wordpad-alert.jpg

    Alert when entering Windows passwords in an insecure application

    How to enable Enhanced Phishing Protection

    While Windows 11 22H2 has Phishing protection enabled by default, the options to protect your passwords are disabled.

     

    To enable these options, go to Start > Settings > Privacy & security > Windows Security > App & browser control > Reputation-based protection settings.

     

    Under the Phishing protection section, you will see two new options labeled 'Warn me about password reuse' and 'Warn me about unsafe password storage.'

     

    When enabled, the 'Warn me about password reuse' option will cause an alert to be displayed when you enter your Windows password on a website, whether it's a phishing site or a legitimate site.

     

    The 'Warn me about unsafe password storage' option will warn you when you type your password into an application like Notepad, Wordpad, and Microsoft Office and then press enter.

     

    To protect your passwords, put a checkmark in both options to enable them, as shown in the image below. When you enable each option, Windows 11 will display a UAC prompt, which you should accept.

     

    phishing-protection-settings.jpg

    Enabling password protection in Windows 11 22H2 Source: BleepingComputer

     

    BleepingComputer created a test account on our Windows 11 22H2 device and entered our password into Notepad to test this feature.

     

    As you can see below, once we typed the password and pressed enter, Windows 11 displayed a warning stating, "It's unsafe to store your password in this app," and recommended we remove it from the file.

     

    password-application-warning.jpg

    Windows 11 warning when you enter your password in Notepad Source: BleepingComputer

     

    We also tested this feature in other applications, such as WordPad, Microsoft Word 2019, Excel 2019, OneNote, and Notepad2. We were not able to test this in Microsoft 365, which Microsoft claims is supported by the feature.

     

    While Windows 11 warned us about our password in WordPad and Microsoft Word, it surprisingly did not warn us when typing it into Excel, OneNote, and Notepad2, which should be fixed.

     

    This is especially true for Microsoft Excel, as it's known to be used to create password lists.

     

    We also tested the password reuse feature by trying to log in to Twitter with our Windows password using Google Chrome and Microsoft Edge. Once we entered our password, Windows 11 displayed the following alert warning us to change our Windows password.

     

    password-reuse-alert.jpg

    Windows 11 warning about password reuse on a website Source: BleepingComputer

     

    However, the Enhanced Phishing Protection feature did not work when testing Mozilla Firefox.

     

    Overall, this is an excellent new security feature for Windows users, and it is strongly recommended that you use it to protect yourself from phishing attacks and from saving your passwords in insecure files.

     

    However, there is still plenty of room for improvement, with Microsoft needing to expand the security feature to support more browsers and applications.

     

     

    Windows 11 now warns when typing your password in Notepad, websites


    User Feedback

    Recommended Comments

    There are no comments to display.



    Join the conversation

    You can post now and register later. If you have an account, sign in now to post with your account.
    Note: Your post will require moderator approval before it will be visible.

    Guest
    Add a comment...

    ×   Pasted as rich text.   Paste as plain text instead

      Only 75 emoji are allowed.

    ×   Your link has been automatically embedded.   Display as a link instead

    ×   Your previous content has been restored.   Clear editor

    ×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...