cognitive-accessibility consideration

[JohnRochfordUMMS]

Hi All,

As a Cognitive Accessibility Task Force member, and as manager of its Accessible Authentication success criterion (SC), I recently reviewed the Web Authentication working draft. I assessed what impact our Accessible Authentication SC might have on it, and how the task force's work could be helpful to it. (I saw nothing in the working draft that I thought would have an impact on our SC.)

Examples

• 3. Terminology contains the following definition. “User consent means the user agrees with what they are being asked, i.e., it encompasses reading and understanding prompts.” I think something fundamental is missing: following prompts. People with cognitive disabilities may lack capabilities needed to follow such prompts.
• Throughout the Web Authentication working draft, there are multiple references to submitting passwords and PINs, to which our SC definitely applies.
• Also, there are references to fixed periods in which user interaction is required. E.g., "4.1.5. Platform Authenticator Availability states “A timeout value on the order of 10 minutes is recommended; this is enough time for successful user interactions to be performed but short enough that the dangling promise will still be resolved in a reasonably timely fashion.” I saw no discussion of enabling users with cognitive disabilities to extend such periods.

If you are interested, I would be pleased to work with you to incorporate cognitive-accessibility elements in the Web Authentication working draft. My aim is to be helpful, not critical.

John Rochford

[equalsJeffH]

@JohnRochfordUMMS:

I would be pleased to work with you to incorporate cognitive-accessibility elements in the Web Authentication working draft

Ok, thx, some questions in return:

1. by which process milestone (CR, PR, REC) do we need to have accessibility issues addressed?
2. have you found additional accessibility issues other than the three noted above in cognitive-accessibility consideration #733 (comment) ? (please submit issues if so)

[JohnRochfordUMMS]

@equalsJeffH

1. I don't know. A W3C staff member will have to guide us.
2. I do not now recall additional accessibility issues. I may once we start working together.

[wseltzer]

Re Q1, at transitions, including to CR, the Director reviews whether all open issues have been formally addressed (see https://www.w3.org/Guide/transitions?profile=CR&cr=new ).

[equalsJeffH]

thx @wseltzer, so the definition of "formally addressed" appears to cover our nominal working process where we have at least examined all open issues (i.e., "triaged" them), and assigned them to a milestone (CR, PR, REC).

So, it would seem to me that we can assign the [subtype:accessibility-cons] issues to, say, the PR #milestone such that we have time to give said issues proper attention, and enter transition-to-CR earlier, yes?

@JohnRochfordUMMS: you said "once we start working together". From our nominal perspective, your having submitted this issue does mean "we are working together". If the present state does not meet your definition of "working together", might you please elaborate what your conception of "working together" entails? thanks.

[JohnRochfordUMMS]

@equalsJeffH: Okay, great, we "are" working together. What's the next step?

[equalsJeffH]

@JohnRochfordUMMS:

Okay, great, we "are" working together. What's the next step?

further review the webauthn spec and submit further issues as appropriate?

[samuelweiler]

Regarding general accessibility review: APA now has this in their work queue and should get back to the WG: https://www.w3.org/WAI/APA/wiki/Web_Authentication:_An_API_for_accessing_Scoped_Credentials_Level_1

Regarding this particular issue: John, could you make some concrete wording suggestions that might address your initial comments (esp. bullets #1 and #3). e.g. is there better hard guidance for the time limit on bullet #3? For #3: The WG might need to think about the consequences of extending the timeout for any user that requests extension - since we can't distinguish why a user might request an extension.

[apowers313]

These links may help as well:

https://w3c.github.io/apa/fast/
https://w3c.github.io/apa/fast/checklist

[JohnRochfordUMMS]

Samuel: "... is there better hard guidance for the time limit on bullet #3? For #3: The WG might need to think about the consequences of extending the timeout for any user that requests extension - since we can't distinguish why a user might request an extension."

John: There is no need for such distinguishing. Here is hard guidance: https://www.w3.org/TR/UNDERSTANDING-WCAG20/time-limits.html.

Samuel: "... could you make some concrete wording suggestions that might address your initial comments (esp. bullets #1 ..."

John: Here is some info about concrete wording suggestions: https://www.w3.org/TR/UNDERSTANDING-WCAG20/meaning-supplements.html and https://www.w3.org/TR/UNDERSTANDING-WCAG20/content-structure-separation-sequence.html

[equalsJeffH]

OK, we will add notes to #creatCredential and #getAssertion saying that UA impls should take cognitive guidelines into considertation ie like allowing users to tweak timeout values as approp for them.