Windows 11 now warns when typing your password in Notepad, websites

Windows 11 22H2 was just unveiled, and with it comes a new security attribute named Improved Phishing Protection that warns end users when they enter their Home windows password in insecure applications or on web-sites.

Windows login credentials are worthwhile to danger actors as they let them to accessibility internal corporate networks for details theft or ransomware assaults.

These passwords are commonly obtained by way of phishing assaults or by users preserving their passwords in insecure apps, this sort of as word processors, textual content editors, and spreadsheets.

In some conditions, simply typing your password in a phishing login form, and not submitting them, is sufficient for them to be stolen by threat actors.

To overcome this behavior, Microsoft launched a new attribute referred to as ‘Enhanced Phishing Protection’ that warns end users when they enter their Windows password on a web-site or enter it into an insecure software.

“SmartScreen identifies and guards versus company password entry on described phishing web pages or apps connecting to phishing websites, password reuse on any application or web page, and passwords typed into Notepad, Wordpad, or Microsoft 365 applications,” clarifies Microsoft Stability Solution Manager Sinclaire Hamilton.

“IT admins can configure for which scenarios close consumers see warnings via CSP/MDM or Group Coverage.”

This new attribute is only out there in Home windows 11 22H2 at this time, and it is not enabled by default. It also needs you to log into Windows with your Home windows password instead than use Home windows Hi there.

So if you use a PIN to log in to Home windows, this feature will not function.

When enabled, Microsoft will detect when you enter your Home windows password and then challenge a warning prompting you to remove the password from an insecure file or, if entered on a web site, to alter your Windows password.

How to allow Increased Phishing Safety

While Home windows 11 22H2 has Phishing protection enabled by default, the solutions to defend your passwords are disabled.

To allow these selections, go to Commence > Options > Privateness & protection > Home windows Safety > Application & browser regulate > Popularity-centered defense configurations.

Below the Phishing protection part, you will see two new alternatives labeled ‘Alert me about password reuse’ and ‘Warn me about unsafe password storage.’

When enabled, the ‘Warn me about password reuse’ possibility will induce an alert to be displayed when you enter your Home windows password on a web-site, irrespective of whether it is a phishing site or a legit web site.

The ‘Warn me about unsafe password storage’ possibility will warn you when you kind your password into an software like Notepad, Wordpad, and Microsoft Office environment and then press enter.

To protect your passwords, put a checkmark in the two solutions to help them, as proven in the picture beneath. When you empower each individual possibility, Windows 11 will screen a UAC prompt, which you should settle for.

BleepingComputer established a examination account on our Windows 11 22H2 device and entered our password into Notepad to take a look at this characteristic.

As you can see beneath, after we typed the password and pressed enter, Home windows 11 displayed a warning stating, “It truly is unsafe to store your password in this application,” and advised we take out it from the file.

We also examined this aspect in other purposes, this sort of as WordPad, Microsoft Phrase 2019, Excel 2019, OneNote, and Notepad2. We have been not capable to take a look at this in Microsoft 365, which Microsoft promises is supported by the function.

While Home windows 11 warned us about our password in WordPad and Microsoft Term, it incredibly did not alert us when typing it into Excel, OneNote, and Notepad2, which ought to be set.

This is specifically real for Microsoft Excel, as it’s known to be utilized to make password lists.

We also analyzed the password reuse attribute by attempting to log in to Twitter with our Home windows password working with Google Chrome and Microsoft Edge. As soon as we entered our password, Home windows 11 exhibited the subsequent alert warning us to transform our Windows password.

Nonetheless, the Increased Phishing Defense characteristic did not operate when tests Mozilla Firefox.

Over-all, this is an superb new security aspect for Home windows people, and it is strongly recommended that you use it to guard you from phishing assaults and from conserving your passwords in insecure data files.

On the other hand, there is still lots of home for enhancement, with Microsoft needing to expand the security function to assist a lot more browsers and applications.