Multiple passwords, same account, different privileges

Question

Many of our clients in the field often need to use untrusted computers to access their account on our website (no 4G/WiFi). We have had multiple cases of credentials being leaked leading to several erroneous sales and refunds, and more importantly, it has inconvenienced them greatly.

As a stopgap, we're considering creating multiple passwords for each user-- one would give them full access, while the other could be used when they travel and doesn't allow purchases, and has stricter session requirements. This is a legacy website that we don't plan to invest more time in, and our clients are technophobes.

Is there any reason to not do this?

Answer 1

Is there any reason to not do this?

Yes, I think of two reasons not to do it:

1. The user may mistakenly enter in their full-access password into a compromised machine.
2. Once a user enters their lower-access password into a compromised machine, now the attacker potentially knows a username and can try to brute-force the other password. This gives the attacker (some) more information than if they didn't know the username of a full-access account at all.

That being said, what you have proposed is probably better than changing nothing and having users login with full-access on potentially compromised machines.

Another thing worth considering is having multiple users with different permissions rather than multiple passwords for the same user. It's only slightly better in that users could still login with the wrong username, though this is probably a little less likely to happen compared to typing username-[tab]-password-[enter] muscle memory. It does solve problem #2 though, and it's also easier to manage a separate user if the account needs to be disabled or you want to track logins.

Other things to consider: not allowing full access users to login outside of a particular network/VPN, only allow full access logins on previously registered computers (with one-time 2FA), or requiring 2FA for every login for (at least) full-access users.

Perhaps the best solution is to never use untrusted machines. Have your users bring their own laptop and always use HTTPS. Or, they could even use their own mobile hotspot if the network cannot be trusted either.

Answer 2

The inherent problem is that the computers are untrusted - multiple passwords going through the same untrusted channel won't really help, and may confuse your clients more than help them.

I would strongly suggest adding a second factor authentication via a trusted channel like your client's smart phone. 2FA does not have to be onerous or complicated.

Begin by making the feature optional, but advertise and recommend it to your customers. Collect feedback and audit whether clients who enable 2FA ever get their credentials compromised.