Add WCAG 2.2 SC 3.3.8 - Accessible Authentication (Minimum) (AA)

[mgifford]

WCAG 2.2 SC 3.3.8:

A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides at least one of the following:

Alternative

Another authentication method that does not rely on a cognitive function test.

Mechanism

A mechanism is available to assist the user in completing the cognitive function test.

Object Recognition

The cognitive function test is to recognize objects.

Personal Content

The cognitive function test is to identify non-text content the user provided to the website.

Note 1

"Object recognition" and "Personal content" may be represented by images, video, or audio.

Note 2

Examples of mechanisms that satisfy this criterion include:
support for password entry by password managers to reduce memory need, and
copy and paste to reduce the cognitive burden of re-typing.

List the tasks for the SC.

Child issue of #65

[mgifford]

Role mapping by ChatGPT and links mostly from me.

AI Generated Role Mapping (ARRM)

• Primary: UX Designer – responsible for shaping authentication flows that don’t rely on cognitive tests.
• Secondary: Front-End Developer – codes support for password managers, copy-paste, biometrics.
• Contributor: Visual Designer – ensures alternatives are visible and clearly presented in the UI.

AI Generated Additional Context

• Requirement: users must not be required to pass a cognitive function test to authenticate (e.g., remembering a password without manager support, solving a puzzle, identifying objects in an image).
• Acceptable options include:
  • Allowing use of password managers.
  • Supporting copy-paste for authentication fields.
  • Providing biometric authentication.
• Exceptions: cognitive function tests are allowed only if another accessible method is also available.
• Common failures: forcing users to memorize and type complex strings, CAPTCHAs without accessible alternatives, login forms that block autofill/copy-paste.

References

• GetStark: Accessible Authentication (Minimum) – explanation and examples
  https://www.getstark.co/wcag-explained/understandable/input-assistance/accessible-authentication-minimum/
• W3C Understanding 3.3.8 – official guidance
  https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html
• BeAccessible – WCAG 2.2 checklist
  https://beaccessible.com/post/wcag-2-2-checklist/
• Parachute Design – WCAG 2.2 overview
  https://parachutedesign.ca/blog/wcag-2/#Success_Criteria_327_%E2%80%9CVisible_Controls%E2%80%9D
• Equally AI – WCAG 2.2 checklist
  https://blog.equally.ai/web-accessibility/wcag-2-2-simple-checklist/
• W3C ARRM – Accessibility Roles & Responsibilities Mapping
  https://www.w3.org/WAI/planning/arrm/

Possible Task List

• Identify cognitive function tests in authentication flows (e.g., password recall, puzzles, manual transcription)
• Ensure alternative authentication methods are available (e.g., magic links, WebAuthn, biometrics, SSO)
• Provide mechanisms to assist existing methods (enable copy/paste, password managers, autocomplete, show password toggle)
• Verify exceptions where cognitive tests are permissible (object recognition or personal content) and clearly document them
• Block disallowed cognitive tests when no alternative/mechanism applies (e.g., disabling puzzles or text transcription where unsupported)
• Test all authentication steps across devices and assistive technology, verifying alternatives/mechanisms work reliably
• Document compliance in team guidelines and accessibility statement, including authentication exceptions and support methods