[WCAG 2.2 Draft Feedback] Success Criterion 3.3.7 Accessible Authentication

[dshoukry]

“Success Criterion 3.3.7 Accessible Authentication (Level A): If an authentication process relies on a cognitive function test, at least one other method must also be available that does not rely on a cognitive function test.”

Most of our comments/proposals are requests to: explicitly clarify some of the definitions, explicitly define how security plays into this topic, add federated identity as an acceptable solution, revise some of the success examples provided, add a section for failure examples, and update some links that 404.

Please find detailed specifics covered in our 3.3.7 Accessible Authentication (Level A) Google Doc.

[cwadamsoforacle]

dshoukry, the link you provide above resolves to a document on 2.5.8 Pointer Target Spacing. I suspect this is not the intended link. Can you update and provide the intended content?

[alastc]

The doc link above has been updated now, thanks @dshoukry

[alastc]

PR #1508 makes some of the updates identified in the document.

In addition, for some of the other comments this is a draft reply to be discussed by the group:

---

• The addition of "federated identity" to the note under the SC text does not support the intent of the note. The note is to notify people who have been thinking the SC bans username/passwords, but that is not the case.
• Adding "It is also important that the success or error messages are accessible and easy to understand" is covered by other success criteria, it is best not to create too much overlap.
• Adding that "The field labels should clearly identify the name of the website or company requesting the user credentials" is not supported by the SC text, it should not be included in the examples.
• The audio output of pin numbers (via WebAuth) is not in scope of the SC, it is up to the user's device as to how that is conveyed.
• "Patterns" in the cognitive functional test definition could refer to either pattern gestures or other patterns, we would rather not restrict it to just gestures.

[alastc]

The group agreed with the PR and the response above.

I'm going to leave this open until I can do another pass and check everything was responded to.

[alastc]

For reference, there have been quite a few changes to the document, from this and other issues. Accessible Auth understanding.

[dshoukry]

Thanks for the updates and for accepting some of the suggestions. I'm gathering internal feedback about the main points and the new updated versions and will provide an update soon.

[alastc]

Hi @dshoukry,

We're going to do another round of review as several SCs have changed significantly. I'll close this as we've dealt with, or replied to, the comments raised. For new feedback, please open a new issue.

Kind regards,

-Alastair