We have a web application which requires users to log in with username and password. We have a password reset feature for users which more or less successfully follows the guidelines outlined by Troy Hunt in this article, with 1 major exception, we have a weak link:
We have an admin portal with a feature which generates a temporary password and displays it on the screen to the Admin was added, with the understanding that this is to be read out over the phone, rather than emailed. To be clear, an admin also has the ability to request a password reset email on behalf of user (and sent to user's registered email), but this is never used.
We have plenty of users who are not very computer literate, and some of them struggle to create/reset a password by themselves (despite the password requirements being clearly signposted before the user enters the new password). To make their job easier our guys have taken to using this temporary password to reset the password themselves to variations on the same common password and reading this out over the phone. I feel this is an unacceptable security risk.
I've tried to convince them that if any admin can reset a password we can't truly identify a user. A user would have carte blanche to say "It wasn't me" to any action they carry out after an Admin has set their password, but they're not convinced that this outweighs the extra difficulty they would face. I've tried to convince them that resetting the password of anyone who asks to the same generic password makes accounts much easier to compromise, again no dice.
I've thought that a legal argument may carry more weight (UK based so GDPR may be a factor) but I don't have the knowledge to explain why (if?) this would be in breach.
Another alternative may be to compromise on something else (perhaps reduce password complexity requirements, although I don't feel they are onerous now) to mitigate the impact of removing this feature.
My colleagues and management are not at all versed in IT security. How can I convince them that this is not an acceptable state of affairs, and carries risks for them personally and for the company? Alternatively, are there any reasonably secure compromises I could offer?