Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a Windows 10 PC that I would like to protect a little better. I've looked for solutions online, but they're all business oriented.
What I would like, in an ideal situation, is having to enter my password and a Google Authenticator code (6 digits) before I can login to my PC. Is there any way I can achieve this?
If not, what's a good way to limit unauthorised access to a PC when it's physically stolen?
The reason you don't find what you're looking for is that 2FA in the static-password + short-changing-code sense is pretty much pointless for a personal computer. It's only useful for network access or if the password grants access to a large number of systems, and is primarily useful as a defense against phishing. None of this tends to apply to a personal computer.
The defense against losing your data if the PC is stolen is encryption. The encryption key must be sufficiently well protected to make it impractical for the thief to find it. The encryption key needs to be the same each time (otherwise you couldn't decrypt data from a previous session). So it must be calculated in a deterministic way from the available data. What (secret) data is available?
A changing code (the kind of second authentication factor that you're looking for) does not help with encryption derived from a password because it changes every time (and if it didn't change every time, it wouldn't add any security because it would just blend into the password). If your computer is stolen and the thief manages to guess or find your password, the thief can take out the hard drive and access it directly, without using any software that would ask for a changing code. (And if the thief can't figure out your password, your data is safe.)
A useful second factor of authentication for encryption is a smart card, which contains the encryption key (or some intermediate key from which the key is derived). This is a different way to use a “what you have” factor, which combined with a password (or a PIN for the card) provides you with a 2FA. The cost for an individual user is something like $20 for a USB reader and a couple of cards. A TPM can serve the same purpose as the smartcard, if there's one on your motherboard, but it's less useful because it would be stolen with the computer, whereas the point of the smart card is that you keep it with you in your wallet.
A changing code could be useful if you have a TPM and you use it to store the disk encryption key. But as far as I'm aware TPM don't support this kind of second what-you-have factor. (There's a good reason for that: validating a changing code requires either a precise clock or keeping track of which codes have been used, and the kind of technology that goes into a secure chip is not very good at either.)
A changing code is not very useful as a second factor if the thief steals the device while it's powered on and the encryption key is in memory. If the thief manages to dump the key from the memory, authentication is irrelevant. If the thief tries to guess the password, the operating system already prevents fast retries, so the thief only gets a very small number of guesses and anything harder to guess than your spouses's name will resist. The only case where a second factor can help with an attack against logging in to a powered-on system is if the thief already knows your password, which is a concern in corporate and commercial environment where phishing is an issue, but typically not for a personal machine.
¹ Not all TPM are protected against invasive physical attacks, but they raise the bar from “worth taking 5 minutes to get some random person's banking information” to “only worth it for juicy corporate secrets”.
