Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain areas of this web application require identification of the user to allow the content to be aligned with the user's capabilities and to prevent user impersonation. The current version is very outdated and uses a very weak username/password-like authentication mechanism, which boils more or less down to unsecured access (abuse has been detected in the past).
I think some kind of MFA, or MFA-based approach is recommended as a replacement for the username/password solution in place. It could be interesting to have an adult, for example, a parent (when used in a home setting) or a teacher (when used at school), confirm access to the online resources on behalf of the user when the user it not able to authenticate for whatever possible reason.
Because some of the users have (very) limited intellectual capabilities, (more) complex mechanisms (like OTP, mobile authenticator, digipass, etc.) are not always suited. Also because of the age range of the target audience (ranging between 8 and 21), we cannot assume every user has access or is allowed to use a smartphone that could be used in the authentication flow. Under such circumstances, parental approval might be a valid alternative solution.
Many possible approaches probably exist to implement such authentication and authorisation solution. Please feel free to share any thoughts/ideas/suggestions to setup such solution.
Currently, a parent or teacher (guardian) registers a child/adolescent (user) via an online registration procedure. This procedure is email based and assigns a username for the user (based on the first name, last name and date of birth), a 3-letter password (limited to the first 10 characters of the alphabet) for the user and a free text guardian password. Using the website, the guardian uses the username/guardian password to add the user account to the local browser (cookie based). When a user want to authenticate, he/she selects his/her picture/avatar and enters the 3-letter password.
My concerns about this approach are:
- Adding avatars using a browser cookie to ease future authentication with such a weak password makes authentication pointless.
- The very limited number of user password combinations possible with 3 characters out of of a set of 10 possibilities makes it very prone to attacks.
- I find the overall procedure somewhat confusing and not very guardian friendly.
I deliberately did not explicitly mention before that the current solution is a browser based platform to keep as many possibilities open as possible. Interviewing guardians and users, we noticed a more or less even distribution among the desire for web based solutions and native mobile solutions (the latter does not exist today).