Verdict

“A Linux-based kiosk solution could offer more granular control over credential management and access restrictions.”

The proposed kiosk setup requires a balance between security and usability, and while there are potential solutions, they involve trade-offs. Using Windows/Edge kiosk mode is straightforward for accessing the LMS without saving passwords. However, for the web app tied to the ERP, saving the kiosk's login credentials securely while preventing employees from saving their own credentials or overriding the kiosk's login is more complex. The suggested Chrome configuration with unassigned access and disabling password saving is a viable approach but not foolproof, as users could still manually save passwords. Exploring Linux-based solutions could provide more flexibility and security, as Linux kiosk distributions often have robust configuration options for managing access and credentials. A solo or 2-person team with relevant technical expertise could likely develop a functional v1 within 4-12 weeks by leveraging existing kiosk software or Linux distributions and configuring them to meet the specific requirements. The key challenge lies in ensuring the security and integrity of the kiosk's login credentials while maintaining a user-friendly experience for employees.

“The kiosk access control problem is already solved by existing OS - level kiosk modes and third - party platforms, so differentiation hinges on integration depth rather than security novelty.”

The core requirement - preventing employees from saving passwords while allowing per - user badge/pin authentication on a shared kiosk - is already addressed by several established solutions. Windows Assigned Access (Edge kiosk mode) and Chrome Enterprise Kiosk mode both lock down the device to a single account, enforce Group Policy or MDM settings that disable password saving, and isolate user profiles so that badge - based login does not interfere with the master kiosk credential. Dedicated kiosk platforms such as KioWare, 42GIGS, and ThinStation provide similar isolation and can be configured to require a secondary PIN or badge for each session, with the master account remaining immutable. Because these tools already deliver the security guarantees the idea seeks, the differentiation rests on superficial implementation details rather than a novel technical barrier. The durability of the solution depends on correct configuration and ongoing policy enforcement; a mis - applied Group Policy or a user who manually overrides the kiosk account can undermine the protection. Moreover, the integration with ERP and LMS can be achieved through standard SSO or API hooks that are widely supported, further reducing the uniqueness of the approach. Consequently, while the idea is practical, its defensible differentiation is weak, leading to a moderate score.

“The setup's complexity and reliance on user discipline for security make it highly vulnerable to breaches and operational inefficiencies.”

The proposed kiosk setup faces significant risks due to its multi-faceted access requirements and the inherent security vs. convenience trade-offs. **1.** **Insufficient Password Protection Mechanism**: Relying on Chrome's unassigned access and disabling password saving is not foolproof. Determined users can still manually save passwords, especially for the LMS, compromising security. **2.** **ERP Web App Vulnerability**: If the single saved login for the kiosk's initial access is compromised (e.g., through physical access to the kiosk's settings or a zero-day exploit in Chrome/Windows), the entire ERP system's accessibility through the kiosk is at risk. **3.** **Scalability and Maintenance Nightmare**: As the number of kiosks grows, managing each unit's configuration, ensuring password policies are strictly adhered to, and updating software becomes a logistical nightmare, potentially leading to inconsistencies and vulnerabilities. **Regulatory Compliance** could also pose a threat if employee data protection standards (e.g., GDPR, CCPA) are not met, especially with shared login practices.

“Isolate the ERP login in a locked-down browser profile while forcing ephemeral sessions for LMS.”

The core challenge is balancing security (preventing password persistence for sensitive systems like LMS) with usability (auto-login for the ERP web app). Your proposed Chrome/Unassigned Access approach is viable but has gaps (manual password saves). A more robust solution exists: use Windows Kiosk Mode with Edge + Group Policy to enforce *no password saving* globally, while leveraging Edge's *profile-based auto-login* for the ERP. Create a dedicated Edge profile for the kiosk, pre-signed into the ERP, and lock it down via GPO to disable password prompts/saves. For LMS, force a fresh Edge instance (InPrivate) with no profile persistence. Linux + Chromium in kiosk mode with similar profile isolation is also clean. The missing piece is *profile separation* - not just disabling saves, but ensuring the ERP's credentials are sandboxed in a non-user-modifiable profile. Unit economics are trivial (hardware + OS licensing), but the value is in reducing support overhead (no sticky notes) and security risks. Margins are high if sold as a managed service (e.g., $500/kiosk setup + $50/month for monitoring).

“The problem is legitimate but shrinking as incumbent platforms absorb the functionality, leaving only a narrowing window for a standalone solution with limited expansion potential.”

This idea addresses a genuine but narrow pain point in enterprise kiosk management, specifically the tension between convenience (saved kiosk-level credentials) and security (preventing credential saving for sensitive apps like LMS). The target audience is clear: mid-to-large enterprises with 100+ employees using shared workstations in manufacturing, healthcare, retail, or logistics - industries where workers clock in, access training, and use ERP systems from floor kiosks. The unmet need is real: IT admins currently hack together solutions with group policy, browser flags, or physical deterrents like keyboard removal. However, the market is fundamentally constrained. First, most enterprises already have Microsoft 365/Intune ecosystems where Edge kiosk mode plus conditional access policies solve 80% of this. Second, the remaining 20% often lacks budget for niche solutions - IT security teams prioritize endpoint management platforms (CrowdStrike, Microsoft Defender) over point solutions. Third, the problem is increasingly being solved upstream: modern identity providers (Okta, Azure AD) now offer kiosk-aware authentication flows, and ERP vendors like SAP and Oracle are building native kiosk modes. The buyer is typically an overworked IT manager with limited discretionary budget, not a C-level sponsor. A venture here would likely max out as a $2-5M ARR niche tool, not a scalable platform. The Linux angle adds complexity without clear differentiation. The real opportunity might be a lightweight SaaS layer that orchestrates browser policies across mixed fleets, but that's crowded by existing MDM players. Worth building as a consultancy or side project, not a venture-backed business.