Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Windows 11 Now Warns when Typing your Password in Notepad, Websites

Windows 11 Now Warns when Typing your Password in Notepad, Websites

Windows 11 22H2 was just released, and with it comes a new security feature called Enhanced Phishing Protection that warns users when they enter their Windows password in insecure applications or on websites.

Windows login credentials are valuable to threat actors as they allow them to access internal corporate networks for data theft or ransomware attacks.

These passwords are commonly acquired through phishing attacks or by users saving their passwords in insecure applications, such as word processors, text editors, and spreadsheets.

In some cases, simply typing your password in a phishing login form, and not submitting them, is enough for them to be stolen by threat actors.

Also Read: You can now delete personal data on internet by asking Google

To combat this behavior, Microsoft introduced a new feature called ‘Enhanced Phishing Protection’ that warns users when they enter their Windows password on a website or enter it into an insecure application.

“SmartScreen identifies and protects against corporate password entry on reported phishing sites or apps connecting to phishing sites, password reuse on any app or site, and passwords typed into Notepad, Wordpad, or Microsoft 365 apps,” explains Microsoft Security Product Manager Sinclaire Hamilton.

“IT admins can configure for which scenarios end users see warnings through CSP/MDM or Group Policy.”

This new feature is only available in Windows 11 22H2 at this time, and it is not enabled by default. It also requires you to log into Windows with your Windows password rather than use Windows Hello.

So if you use a PIN to log in to Windows, this feature will not work.

When enabled, Microsoft will detect when you enter your Windows password and then issue a warning prompting you to remove the password from an insecure file or, if entered on a site, to change your Windows password.

Alert when entering Windows passwords in an insecure application
Alert when entering Windows passwords in an insecure application

How to enable Enhanced Phishing Protection

While Windows 11 22H2 has Phishing protection enabled by default, the options to protect your passwords are disabled.

To enable these options, go to Start Settings Privacy & security > Windows Security App & browser control > Reputation-based protection settings.

Under the Phishing protection section, you will see two new options labeled ‘Warn me about password reuse’ and ‘Warn me about unsafe password storage.’

Also Read: Retention Limitation Obligation: What every organization should know

When enabled, the ‘Warn me about password reuse’ option will cause an alert to be displayed when you enter your Windows password on a website, whether it’s a phishing site or a legitimate site.

The ‘Warn me about unsafe password storage’ option will warn you when you type your password into an application like Notepad, Wordpad, and Microsoft Office and then press enter.

To protect your passwords, put a checkmark in both options to enable them, as shown in the image below. When you enable each option, Windows 11 will display a UAC prompt, which you should accept.

Enabling password protection in Windows 11 22H2
Enabling password protection in Windows 11 22H2
Source: BleepingComputer

BleepingComputer created a test account on our Windows 11 22H2 device and entered our password into Notepad to test this feature.

As you can see below, once we typed the password and pressed enter, Windows 11 displayed a warning stating, “It’s unsafe to store your password in this app,” and recommended we remove it from the file.

Windows 11 warning when you enter your password in Notepad
Windows 11 warning when you enter your password in Notepad
Source: BleepingComputer

We also tested this feature in other applications, such as WordPad, Microsoft Word 2019, Excel 2019, OneNote, and Notepad2. We were not able to test this in Microsoft 365, which Microsoft claims is supported by the feature.

While Windows 11 warned us about our password in WordPad and Microsoft Word, it surprisingly did not warn us when typing it into Excel, OneNote, and Notepad2, which should be fixed.

This is especially true for Microsoft Excel, as it’s known to be used to create password lists.

We also tested the password reuse feature by trying to log in to Twitter with our Windows password using Google Chrome and Microsoft Edge. Once we entered our password, Windows 11 displayed the following alert warning us to change our Windows password.

Windows 11 warning about password reuse on a website
Windows 11 warning about password reuse on a website
Source: BleepingComputer

However, the Enhanced Phishing Protection feature did not work when testing Mozilla Firefox.

Overall, this is an excellent new security feature for Windows users, and it is strongly recommended that you use it to protect yourself from phishing attacks and from saving your passwords in insecure files.

However, there is still plenty of room for improvement, with Microsoft needing to expand the security feature to support more browsers and applications.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us