elearning pin authentication

Question

I work on a health and safety website which provides an online course with certification. We have recently strengthened security by hashing admin passwords.

The question relates to the user's access to the course. Currently an administrator will activate a student's serial by nominating a username. They then give this to the student who is responsible for setting their own password which is also hashed.

The issue is since hashing user passwords, it takes much longer for students to activate serials and access/complete the course. Previously, the administrator would activate a student serial on their behalf with a choice of username. The system would then automatically generate a unique password of approx. 12 characters which was stored in plain text. This meant the administrator could activate a series of logins for say 12 students at a time and print/issue a PDF with their full login. This system was much easier for everyone to understand, but of course the administrator could see their passwords.

What I am wondering, is there a distinction in security circles between passwords and an access code/pin. Say just a series of 3 inputs/select menus accepting values 1-10 for the user access instead of password. So the simplified pin could be stored/printed in plain text, on the understanding it is only temporary and will be erased as soon as the course is complete?

The idea is if its just a 3 digit pin then even if stored in plain text it is of no use to a hacker, because it is not going to be accepted as a password on any other typical website. Also only 2 attempts could be permitted to login before locking to avoid brute force attacks. The user may only need the access-pin for up to an hour while they complete the course before it is erased from the database. Is there a secure way of reverting back to a more simplified username + pin-based login for temporary e-learner access?

Answer 1

There are a bunch of different questions packed in here, so I'm just going to answer the surface-level ones.

---

Are temporary / single-use PINs acceptable in security circles?

Absolutely, but only if it's either A) one time use, or B) sufficiently long to prevent brute-forcing (ie 256 bits of randomness).

Example A: Google account verification email, the thing that's blanked out is a random one time use access token. If you try to click it twice, the second try will bounce:

Example B: It's also common to use this for generating a link for anonymous access to content, but here it's not one time use so the token needs sufficiently long and sufficiently random to prevent brute-forcing.

---

Is a 3 digit PIN long enough?

Maybe? Locking out a PIN after 2 incorrect attempts may solve your problem, but it also presents an easy avenue for an attacker to DOS your service (ie keep your users perpetually locked out and thus block them from accessing the service).

Personally, I would ditch the idea that the PIN is "replacing" a password, and instead follow Google's lead by emailing out a long one-time-use link that tells the server which user and which course to grant them access to. This will be both lower friction for your users, and less to go wrong from a security perspective.