Is having multiple correct passwords for a single username a security problem?

Question

This question occurred to me when using online banking. My wife and I have a joint account. The username to login to internet banking is just our account number, so it is the same for both of us. Nevertheless the bank supplied us with 2 distinct passwords.

If the passwords where only given out by the bank and we would log into the same account this would probably be fine.

But first the bank actually forces us to each choose our own new password. In theory I could choose the same password as my wife and then the system would tell me 'you can't use this password because it is already taken' or something like that so I would have guessed my wifes password. Seems securitywise very shady.

Secondly although we access the same money in the bank account we don't have the exact same user account in the bank as for some actions the identity of the user is needed (for example 'please send a new credit card', should it be for me or for my wife?). The situation of one username combined with one password accesses one user account, the same username with another password accesses a different user account looks to me like a severe breach of security.

Is this actually fine or is the bank using some very sloppy and potentially unsafe programming for their joint accounts?

Edit: To specify what I'm mostly interested in. I'm not too worried that some third party hacker could break into our account because of this. I'm interested in the general principle. If I apply the same principle with all users instead of just 2 I would get a system where no username is needed and I identify users simply by the password they enter. This surely would count as not proper security. My question is whether this general problem counts as 'something to avoid in all situations' or more as 'it's fine as long the number of passwords is small' for some value of small.

Answer 1

Your account is as secure as the weakest password able to access it. If one password is K_ig6W952B[1DGF3&8q.V^-}0ZN?rbDZ and the other password is Despacito2, then the effective security is almost nothing.

Assuming that both passwords are equal, there are still twice as many passwords as usual, meaning that a hacker attempting to crack hashes for your password will only work for half as long.

In practice, this will make no difference. You will lose 1 bit of security, which can be offset by just increasing the length of the password in your password manager.