I use Windows 8.1 Pro 64 bit and IE11. I have two personal certificates (with private key) of mine in the system certificate store. They are both set to require a password before they can be used.

This worked until a few days ago. Then I noticed that one of them is accessible without a password. How could that happen?

What I normally do is:

* I open a HTTPS website that requires certificate auth
* the dialog pops up to select a certificate (only one is offered, based on the CA, each of my certs are from different CAs)
* after I select it, another system dialog appears, asking to grant or deny access to the certificate and for granting, I must enter the password
* after entering the correct password, the website loads

This worked like this for both of the certificates (each used on a different website).
But recently, one certificate does not require the password any more. I can just select it and use it to access the website. The other still requires the password.

To check my memory is not playing tricks with me, I restored a system image backup a few month old. It has Windows 8 Pro and IE10. There both certificates ask for a password.
(I upgraded that system to Windows 8.1 via the Windows Store).

I don't see a way to change the security level of certificates after they are imported, so I did not do it myself and the forget about it.

I can re-import the certificate and set a password for it, but the question is, how did this happen? I checked the PC for malware (booting from a USB key: HBCD and Ubuntu) and found nothing.