I have a Windows 10 PC that I would like to protect a little better. I've looked for solutions online, but they're all business oriented.

What I would like, in an ideal situation, is having to enter my password and a Google Authenticator code (6 digits) before I can login to my PC. Is there any way I can achieve this?

If not, what's a good way to limit unauthorised access to a PC when it's physically stolen?

  • 3
    Good question, but still worth a quick note. The best ways to protect against a stolen computer are pretty standard: using a strong password, enabling full disk encryption, and locking your computer when you step away. Those steps alone are pretty much guaranteed to keep your personal data secure in the event your machine is stolen – Conor Mancone Dec 28 '20 at 11:22

The reason you don't find what you're looking for is that 2FA in the static-password + short-changing-code sense is pretty much pointless for a personal computer. It's only useful for network access or if the password grants access to a large number of systems, and is primarily useful as a defense against phishing. None of this tends to apply to a personal computer.

The defense against losing your data if the PC is stolen is encryption. The encryption key must be sufficiently well protected to make it impractical for the thief to find it. The encryption key needs to be the same each time (otherwise you couldn't decrypt data from a previous session). So it must be calculated in a deterministic way from the available data. What (secret) data is available?

  • Data stored on the computer is pointless because if the computer is stolen, the thief will have this data.
  • Secret data can be stored inside a separate chip that will only reveal the secret if given a password, and that is physically protected so that the thief can't just read the data from it. In practice, this means a TPM¹.
  • Your password can be used as data that's in your mind.
  • You can use additional data that is stored on a separate physical device that you carry with you. In practice, this means a smart card. (A QR code might be a practical alternative if you aren't worried about hidden cameras, but I haven't seen ready-to-use software for that.)

A changing code (the kind of second authentication factor that you're looking for) does not help with encryption derived from a password because it changes every time (and if it didn't change every time, it wouldn't add any security because it would just blend into the password). If your computer is stolen and the thief manages to guess or find your password, the thief can take out the hard drive and access it directly, without using any software that would ask for a changing code. (And if the thief can't figure out your password, your data is safe.)

A useful second factor of authentication for encryption is a smart card, which contains the encryption key (or some intermediate key from which the key is derived). This is a different way to use a “what you have” factor, which combined with a password (or a PIN for the card) provides you with a 2FA. The cost for an individual user is something like $20 for a USB reader and a couple of cards. A TPM can serve the same purpose as the smartcard, if there's one on your motherboard, but it's less useful because it would be stolen with the computer, whereas the point of the smart card is that you keep it with you in your wallet.

A changing code could be useful if you have a TPM and you use it to store the disk encryption key. But as far as I'm aware TPM don't support this kind of second what-you-have factor. (There's a good reason for that: validating a changing code requires either a precise clock or keeping track of which codes have been used, and the kind of technology that goes into a secure chip is not very good at either.)

A changing code is not very useful as a second factor if the thief steals the device while it's powered on and the encryption key is in memory. If the thief manages to dump the key from the memory, authentication is irrelevant. If the thief tries to guess the password, the operating system already prevents fast retries, so the thief only gets a very small number of guesses and anything harder to guess than your spouses's name will resist. The only case where a second factor can help with an attack against logging in to a powered-on system is if the thief already knows your password, which is a concern in corporate and commercial environment where phishing is an issue, but typically not for a personal machine.

¹ Not all TPM are protected against invasive physical attacks, but they raise the bar from “worth taking 5 minutes to get some random person's banking information” to “only worth it for juicy corporate secrets”.

  • I get it, I didn't think of the fact that you can just take out the hard disk. I have BitLocker enabled, is that sufficient? – Sherlock Dec 28 '20 at 12:59
  • @Sherlock BitLocker enables full disk encryption, aka as long as the attacker cannot guess your BitLocker password, they cannot read your data, even if they just pull it out and mount it on a different machine. – Conor Mancone Dec 28 '20 at 13:19
  • And just for my understanding: I don't have a separate BitLocker password - I just login to Windows, right? -- Something that happened to me before was that I brought an older Windows laptop to a computer repair shop without remembering the password, and they were able to just login using a some kind of program. Is that still possible? Because then passwords on Windows are entirely useless ofcourse. – Sherlock Dec 28 '20 at 13:27
  • 2
    @Sherlock If you've set up Bitlocker correctly, the key is derived from your password. – Gilles 'SO- stop being evil' Dec 28 '20 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.