I work on a health and safety website which provides an online course with certification. We have recently strengthened security by hashing admin passwords.
The question relates to the user's access to the course. Currently an administrator will activate a student's serial by nominating a username. They then give this to the student who is responsible for setting their own password which is also hashed.
The issue is since hashing user passwords, it takes much longer for students to activate serials and access/complete the course. Previously, the administrator would activate a student serial on their behalf with a choice of username. The system would then automatically generate a unique password of approx. 12 characters which was stored in plain text. This meant the administrator could activate a series of logins for say 12 students at a time and print/issue a PDF with their full login. This system was much easier for everyone to understand, but of course the administrator could see their passwords.
What I am wondering, is there a distinction in security circles between passwords and an access code/pin. Say just a series of 3 inputs/select menus accepting values 1-10 for the user access instead of password. So the simplified pin could be stored/printed in plain text, on the understanding it is only temporary and will be erased as soon as the course is complete?
The idea is if its just a 3 digit pin then even if stored in plain text it is of no use to a hacker, because it is not going to be accepted as a password on any other typical website. Also only 2 attempts could be permitted to login before locking to avoid brute force attacks. The user may only need the access-pin for up to an hour while they complete the course before it is erased from the database. Is there a secure way of reverting back to a more simplified username + pin-based login for temporary e-learner access?