2

Many of our clients in the field often need to use untrusted computers to access their account on our website (no 4G/WiFi). We have had multiple cases of credentials being leaked leading to several erroneous sales and refunds, and more importantly, it has inconvenienced them greatly.

As a stopgap, we're considering creating multiple passwords for each user-- one would give them full access, while the other could be used when they travel and doesn't allow purchases, and has stricter session requirements. This is a legacy website that we don't plan to invest more time in, and our clients are technophobes.

Is there any reason to not do this?

4
  • Are you using HTTPS? Commented Jun 20, 2016 at 5:36
  • 1
    Have you tried implementing two-factor authentication? I would recommend Duo Security. Commented Jun 20, 2016 at 6:11
  • We are using HTTPS. 2FA might require more effort than we're ready to invest (adding password_2 to the model is a small and easy hack). But this looks promising @MarcWoodyard.
    – Jedi
    Commented Jun 20, 2016 at 11:02
  • A proper and user-friendly way to implement such feature would be to have three fields on the authentication page: the classical login and password, but between them add an "access level" (for instance) drop-down field. So the user type his credential, select the access level he wants to use and type the appropriate password for his user at this access level. However, this may require too much work since, as per my understanding, you have given up in doing clean things with this legacy website ;) ! Commented Jun 20, 2016 at 17:00

2 Answers 2

4

Is there any reason to not do this?

Yes, I think of two reasons not to do it:

  1. The user may mistakenly enter in their full-access password into a compromised machine.
  2. Once a user enters their lower-access password into a compromised machine, now the attacker potentially knows a username and can try to brute-force the other password. This gives the attacker (some) more information than if they didn't know the username of a full-access account at all.

That being said, what you have proposed is probably better than changing nothing and having users login with full-access on potentially compromised machines.

Another thing worth considering is having multiple users with different permissions rather than multiple passwords for the same user. It's only slightly better in that users could still login with the wrong username, though this is probably a little less likely to happen compared to typing username-[tab]-password-[enter] muscle memory. It does solve problem #2 though, and it's also easier to manage a separate user if the account needs to be disabled or you want to track logins.

Other things to consider: not allowing full access users to login outside of a particular network/VPN, only allow full access logins on previously registered computers (with one-time 2FA), or requiring 2FA for every login for (at least) full-access users.

Perhaps the best solution is to never use untrusted machines. Have your users bring their own laptop and always use HTTPS. Or, they could even use their own mobile hotspot if the network cannot be trusted either.

3

The inherent problem is that the computers are untrusted - multiple passwords going through the same untrusted channel won't really help, and may confuse your clients more than help them.

I would strongly suggest adding a second factor authentication via a trusted channel like your client's smart phone. 2FA does not have to be onerous or complicated.

Begin by making the feature optional, but advertise and recommend it to your customers. Collect feedback and audit whether clients who enable 2FA ever get their credentials compromised.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .