4

WCAG is a set of standard web accessibility criteria developed by the W3C that have been adopted by regulatory agencies in a number of countries, including Section 508 in the U.S., which makes compliance mandatory for all government websites.

The current working draft of WCAG 2.2 introduces a new success criterion, 3.3.7: Accessible Authentication. This is a level-A criterion, meaning it must be met in order to claim any degree of compliance.

The success criterion has the following definition:

Success Criterion 3.3.7 Accessible Authentication (Level A): If an authentication process relies on a cognitive function test, at least one other method must also be available that does not rely on a cognitive function test.

The definition of a cognitive function test is given in part as:

A task that requires the user to remember, manipulate, or transcribe information... includ[ing]... memorization, such as remembering a username [or] password[;]... transcription, such as typing in chracters;... performance of calculations; [or] solving of puzzles.

What I'm most concerned about is captcha, which appears to be completely barred by this criterion. The standard "wavy text" captcha is barred as "transcription;" the standard "accessible alternative" audio captcha is also "transcription." The historical alternative "math problem" captcha is "performance of [a] calculation." And the modern captcha is almost blatantly called out by the standard as "solving [a] puzzle" ("identifying which images include a particular object").

How can we verify that an agent accessing a system is indeed a human while still complying with WCAG 2.2 criterion 3.3.7?

2 Answers 2

3

I don't think it outlaws every form of CAPTCHA based on the current text

Exception: When the cognitive function test is to recognize common objects or content the user provided to the website.

1

Put bluntly, the standard requires a non-captcha method of access be available because captchas failing to distinguish a person's humanity is an accessibility issue. More to the point, you shouldn't be trying to determine if a visitor is human, but whether they are authorized user.

Practically, this means that you can't gate login on a captcha solve -- which you shouldn't be doing anyway. If you're concerned an attacker might brute-force a user's password, then you should implement a proper second factor rather than a halfway-measure like a captcha.

Implement WebAuthn so people can use USB push-button tokens, and all your problems will be solved.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .