Ask for optional second password that is used for read only access. Save it after the main password. This is same format as tightvnc uses.