Password fields

[allanj-uaag]

Recently, on a WAI call the topic of Password Fields came up. The Cognitive Taskforce (COGA) has a paper explaining the cognitive issues around passwords https://rawgit.com/w3c/coga/master/issue-papers/privacy-security.html.

Are there any low vision issues related to passwords and security?

[lauracarlson]

Distorted photographs used for CAPTCHA (No alternative provided) from our use cases:

A person with low vision wants to write a research paper and use a scholar service to alert her of new information. When attempting to sign up she is initially presented with a check box, which says "I'm not a bot". She checks the box.

Then she is presented with a modal dialog, which states "Select all images with street name signs" along with nine photographs (street sign screen capture #1 (.png file)). She has difficulty in identifying the images so she tries again.

Another group of photos appear with the same instruction, "Select all images with street name signs" (street sign screen capture #2 (.png file)).

After voluminous attempts, an error dialog box appears (error screen capture #3 (.png file)).

This experience of numerous, steadfast yet unsuccessful attempts to prove she is a human results in fatigue, frustration, being unable to sign up for the Web service independently, and ultimately having to ask for assistance from another person.

[allanj-uaag]

excellent discussion https://www.w3.org/2016/04/27-lvtf-minutes.html

[shawna-slh]

somewhat related to CAPTCHA

[samccormack]

We should require masking characters to meet WCAG size and contract requirements for text. Additionally we need to make sure there is a 1 to 1 ratio of masking characters to password characters.

[allanj-uaag]

Proposal
User Need - Password: Users need to be able to see the entire password as text before it is submitted.

[shawna-slh]

discussed in June 2 telecon.
Action: Shawn try putting it in the revised 3.7.1 and ask TF to review it.

[shawna-slh]

These password issues are usability issues for everyone, more significant for many people with cognitive disabilities, and seem only somewhat more of an issue for people with low vision. I'm not convinced that it warrants adding a low vision user need/requirement.

I propose that it doesn't quite meet the threshold for including in this LV user needs doc at this time, and we mark it as a Best Practice. (Hopefully before too long we'll get to working more on Best Practice doc!) We can add it to the LV user needs doc later if warranted.

[lauracarlson]

+1 to marking as a best practice.