Dostępne uwierzytelnianie
Objaśnienie KS 3.3.8

Tłumacz to Objaśnienie

While websites that use the recognition of objects or content provided by the user the exception pass this SC, they do not fully support the cognitive accessibility community and should be avoided if possible. Refer to the level AAA understanding document for guidance to be fully inclusive and accessible. This includes recognizing a picture.

Intent of Accessible Authentication

The purpose of this Success Criterion is to ensure there is an accessible, easy-to-use, and secure method to log in. Most web sites rely on usernames and passwords for logging in. Memorizing a username and password (or transcribing it manually) places a very high or impossible burden upon people with certain cognitive disabilities.

Remembering a site-specific password is a cognitive function test. Such tests are known to be problematic for many people with cognitive disabilities. Whether it is remembering random strings of characters, a pattern gesture to perform on a touch screen, or identifying which images include a particular object, cognitive function tests will exclude some people. When a cognitive function test is used, at least one other authentication method must be available which is not a cognitive function test.

If there is more than one step in the authentication process, such as with multi-factor authentication, all steps need to comply with this Success Criterion to pass. There needs to be a path through authentication that does not rely on cognitive function tests.

Being able to recover or change the email and password is an important part of authentication. If the user is authenticating with alternative information in order to recover their account, there needs to be a method that is not a cognitive function test.

Many organizations are required to use 2-factor authentication that combines independent sources to confirm a user’s identity. These sources can consist of combining authentication through:

• knowledge (e.g., password, letters in a passphrase or memorized swipe path);
• possession (e.g., through receipt of a one time password generated, or received on a device, or scanning of a QR code on an external device);
• biometrics (e.g., fingerprint scanning, facial recognition or keystroke dynamics).

Most knowledge-based authentication methods rely on a cognitive function test and so mechanisms to assist users must be available. When authentication relies on performing an action on a separate device, it needs to be possible to complete the action without transcribing information. It may not be possible to know what device-based authentication methods are available to a user; offering a choice of methods can allow them to choose the path that most suits them.

Web sites can employ username (or email) and password inputs as an authentication method if it enables the user agent (browsers and third-party password managers) to fill in the fields automatically. If the login form meets Success Criterion 1.3.5 Input Purpose, and the form controls have an appropriate accessible name in accordance with Success Criterion 4.1.2 Name, Role, Value, the user agent can reliably recognize the fields and automatically fill them in. However, if the user agent is blocked from filling in the fields by a script then the page would not pass this criterion because it prevents the mechanism from working.

Copy and paste

Copy and paste can be relied on to avoid transcription. Users can copy their login credentials from a local source (such as a standalone third-party password manager) and paste it into the username and password fields on a login form, or into a web-based command line interfaces asking for a password. Blocking people from pasting into authentication fields, or using a different format between the copied text and the input field (for example, "Enter the 3rd, 4th, and 6th character of your password"), would force the user to transcribe information and therefore fail this criterion, unless another method is available.

Object Recognition

If a CAPTCHA is used as part of an authentication process, there must be a method that does not include a cognitive function test, unless it meets the exception. If the test is based on something the website has set such as remembering or transcribing a word, or recognizing a picture the website provided, that would be a cognitive functional test. Recognizing objects, or a picture the user has provided is a cognitive function test; however, it is excepted at the AA level. Some forms of object recognition may require an understanding of a particular culture. For example, taxis can appear differently in different locales. This is an issue for many people, including people with disabilities, but it is not considered an accessibility-specific issue.

Some CAPTCHAs and cognitive function tests used for authentication may only appear in certain situations, such as when ad blockers are present, or after repeated incorrect password entry. This criterion applies when these tests are used regardless of whether they are used every time or only triggered by specific scenarios.

There are a number of technologies that can be employed to prevent scripted abuse of the authentication process.

• 1.1.1. Rate-limited Access
• 1.1.2. Client Geo-Location
• 1.1.3. Private Client Authentication

None of these systems are 100% effective. However, they may reduce the likelihood of a CAPTCHA being displayed.

Another factor that can contribute to cognitive load is hiding characters when typing. Although this criterion requires that users do not have to type in (transcribe) a password, there are scenarios where that is necessary such as creating a password to be saved by a password manager. Providing a feature to optionally show a password can improve the chance of success for some people with cognitive disabilities or those who have difficulties with accurately typing.

Personal Content

Personal content is sometimes used as a second factor for authentication. For example, as part of account creation the user would upload a picture, and when logging in they would be asked to select that picture from several possible alternatives. Care must be taken to provide adequate security in this case, since non-legitimate users might be able to guess the correct personal content when presented with a choice.

Text-based personal content does not qualify for this exception as it relies on recall (rather than recognition), and transcription (rather than selecting an item). Whilst picture-based personal content will still be a barrier for some people, text based versions tend to be a much larger barrier.

Hiding characters

Another factor that can contribute to cognitive load is hiding characters when typing. Although this criterion requires that users do not have to type in (transcribe) a password, there are non-authentication scenarios where that is necessary. For example, creating a password to be saved by a password manager. Providing a feature to toggle the visibility of password can improve the chance of success for some people with cognitive disabilities or those who have difficulties with accurately typing.

Benefits of Accessible Authentication

People with cognitive issues relating to memory, reading (for example, dyslexia), numbers (for example, dyscalculia), or perception-processing limitations will be able to authenticate irrespective of the level of their cognitive abilities.

Examples of Accessible Authentication

• A web site uses a properly marked up username (or email) and password fields as the login authentication (meeting Success Criterion 1.3.5 Input Purpose and Success Criterion 4.1.2: Name, Role, Value). The user's browser or integrated third-party password manager extension can identify the purpose of the inputs and automatically fill in the username and password.
• A web site does not block paste functionality. The user is able to use a third-party password manager to store credentials, copy them, and paste them directly into a login form.
• A web site uses WebAuthn so the user can authenticate with their device instead of username/password. The user's device could use any available modality. Common methods on laptops and phones are facial-scan, fingerprint, and PIN (Personal Identification Number). The web site is not enforcing any particular use, it is assumed a user will setup a method that suits them.
• A web site offers the ability to login with a third-party provider using the OAuth method.
• A web site that requires two-factor authentication allows for multiple options for the 2nd factor, including a USB-based method where the user simply presses a button to enter a time-based token.
• A web site that requires two-factor authentication displays a QR code which can be scanned by an app on a user's device to confirm identity.
• A web site that requires two-factor authentication sends a notification to a user's device. The user must use their device's authentication mechanism (for example, user-defined PIN, fingerprint, facial recognition) to confirm identity.

Techniques for Accessible Authentication

Resources

• Security and Privacy Technologies issue paper from the Cognitive Task Force.
• WebAuthN specification.
• Web Authentication API on MDN.
• WebAuthN Demo site.
• OAuth on Wikipedia.
• "Let them paste passwords", from the UK's National Cyber Security Centre