Admin
- 69,726
- 25,520
I recently bought a new Win11 laptop to replace my old Win10 laptop that was failing (but well backed-up). Adjusting to Win11 was no fun, but I mostly can get around in it now. One of the things that my new Win11 laptop asked me during the initial setup was if I wanted to link my phone with the laptop.
That seemed like a feature that should be relatively benign and maybe could offer some useful tasks (like transferring files, etc.), so I clicked Yes and it established the link. Okay so far. Occasionally the laptop would pop up a window to show information about my phone, and even some old message history, but nothing alarming.
Then today I was paying bills on the laptop, and was signing into one of my financial accounts with my username/password. As usual, it asked where it should sent the TFA verification code, and I clicked on my cell phone number. The message was sent to my phone, but also popped up on my laptop right next to the box in my browser where I was supposed to type in the TFA verification code. WHAATTT??!!!
That was bad, and alarmed me a lot. It looked like allowing the phone-to-computer link in my standard Win11 setup (suggested by Microsoft) defeated TFA, which seems like a fundamental mistake by whoever designed that into Win11. I did a search on "Does linking your PC to your phone defeat Two Factor Authentication?", and got lots of hits saying yes. The fix is to go into the PC-to-Phone app on the laptop and in the Settings menu you turn off allowing messages and notifications to be sent from the phone to the laptop. I tested it after making this change (and still paying bills), and it seems to have worked.
So if you've allowed that connection between your phone and computer, keep in mind that it defeats TFA. If a hacker got access to your laptop (by whatever means) and managed to compromise some of your passwords to important accounts, you don't have that extra layer of TFA to protect your accounts.
That seemed like a feature that should be relatively benign and maybe could offer some useful tasks (like transferring files, etc.), so I clicked Yes and it established the link. Okay so far. Occasionally the laptop would pop up a window to show information about my phone, and even some old message history, but nothing alarming.
Then today I was paying bills on the laptop, and was signing into one of my financial accounts with my username/password. As usual, it asked where it should sent the TFA verification code, and I clicked on my cell phone number. The message was sent to my phone, but also popped up on my laptop right next to the box in my browser where I was supposed to type in the TFA verification code. WHAATTT??!!!
That was bad, and alarmed me a lot. It looked like allowing the phone-to-computer link in my standard Win11 setup (suggested by Microsoft) defeated TFA, which seems like a fundamental mistake by whoever designed that into Win11. I did a search on "Does linking your PC to your phone defeat Two Factor Authentication?", and got lots of hits saying yes. The fix is to go into the PC-to-Phone app on the laptop and in the Settings menu you turn off allowing messages and notifications to be sent from the phone to the laptop. I tested it after making this change (and still paying bills), and it seems to have worked.
So if you've allowed that connection between your phone and computer, keep in mind that it defeats TFA. If a hacker got access to your laptop (by whatever means) and managed to compromise some of your passwords to important accounts, you don't have that extra layer of TFA to protect your accounts.