I've been asked to add a feature to a website to require a pin for users. The site currently uses username and password. If a user wants to change their password they need to supply the current password OR use a "password reminder" feature that sends a one-time-login token to their e-mail address.
There is a request to add a numeric pin code (at least 4 digits) so that user's would authenticate with username+password+pin code. We would need to add the pin code into the account management form and, I guess, let users change the pin if they can remember their previous pin OR they use the one-time-login feature.
- Does this actually help security in some way?
- Is it more effective if the pin is on the main login screen or a second page in a multi-step form?
- If we can easily enforce a password policy, (requiring a digit, special character, etc.) is that more or less helpful?
I'm interested in lots of perspectives here and will choose an answer that presents pros and cons to these strategies.