Is it possible to design a system with two passwords prompts?

Yes, TOTP is the first thing that comes to mind: user enters his login and password, if they are correct the system asks for the TOTP. This should be the default login system everywhere.

I have something like that on one of my servers: if you SSH in from within the VPN connection, you can login just with key authentication. If you reach the external IP, you must provide a TOTP too.

the hacker stealing the local password is useless because he will not be able to login remotely without the remote password.

If the hacker can steal the first password via social engineering, he will surely be able to steal the second too.

The second password will be tied to the Network Interface NIC (IO interrupt) so that the system would know when a user is attempting to login remotely and when user is logging locally.

And this is easy defeated.

As soon as the hacker runs code on the local computer, he can do anything. He can install a proxy and access it remotely, and to the system the access is local. He could keep a program running, talking to hacker's controlled system to either provide real time execution (a console) or send/receive data periodically.

If your system needs security, use TOTP, or a hardware token, or both. That's what Multi Factor Authentication is implemented.

Is it possible to design a system with two passwords prompts?

Yes, TOTP is the first thing that comes to mind: user enters his login and password, if they are correct the system asks for the TOTP. This should be the default login system everywhere.

I have something like that on one of my servers: if you SSH in from within the VPN connection, you can login just with key authentication. If you reach the external IP, you must provide a TOTP too.

the hacker stealing the local password is useless because he will not be able to login remotely without the remote password.

If the hacker can steal the first password via social engineering, he will surely be able to steal the second too.

The second password will be tied to the Network Interface NIC (IO interrupt) so that the system would know when a user is attempting to login remotely and when user is logging locally.

And this is easy defeated.

As soon as the hacker runs code on the local computer, he can do anything. He can install a proxy and access it remotely, and to the system the access is local. He could keep a program running, talking to hacker's controlled system to either provide real time execution (a console) or send/receive data periodically.

If your system needs security, use TOTP, or a hardware token, or both. That's how Multi Factor Authentication is implemented.

Is it possible to design a system with two passwords prompts?

Yes, TOTP is the first thing that comes to mind: user enters his login and password, if they are correct the system asks for the TOTP. This should be the default login system everywhere.

I have something like that on one of my servers: if you SSH in from within the VPN connection, you can login just with key authentication. If you reach the external IP, you must provide a TOTP too.

the hacker stealing the local password is useless because he will not be able to login remotely without the remote password.

If the hacker can steal the first password via social engineering, he will surely be able to steam the second too.

The second password will be tied to the Network Interface NIC (IO interrupt) so that the system would know when a user is attempting to login remotely and when user is logging locally.

And this is easy defeated.

As soon as the hacker runs code on the local computer, he can do anything. He can install a proxy and access it remotely, and to the system the access is local. He could keep a program running, talking to hacker's controlled system to either provide real time execution (a console) or send/receive data periodically.

If your system needs security, use TOTP, or a hardware token, or both. That's what Multi Factor Authentication is implemented.

Is it possible to design a system with two passwords prompts?

Yes, TOTP is the first thing that comes to mind: user enters his login and password, if they are correct the system asks for the TOTP. This should be the default login system everywhere.

I have something like that on one of my servers: if you SSH in from within the VPN connection, you can login just with key authentication. If you reach the external IP, you must provide a TOTP too.

the hacker stealing the local password is useless because he will not be able to login remotely without the remote password.

If the hacker can steal the first password via social engineering, he will surely be able to steal the second too.

The second password will be tied to the Network Interface NIC (IO interrupt) so that the system would know when a user is attempting to login remotely and when user is logging locally.

And this is easy defeated.

As soon as the hacker runs code on the local computer, he can do anything. He can install a proxy and access it remotely, and to the system the access is local. He could keep a program running, talking to hacker's controlled system to either provide real time execution (a console) or send/receive data periodically.

If your system needs security, use TOTP, or a hardware token, or both. That's what Multi Factor Authentication is implemented.