Webinar: Making FIDO Deployments Accessible to Users with Disabilities

1. Making FIDO Deployments Accessible to
Users with Disabilities
Yao Ding, Meta
Joyce Oshita, Vmware
FIDO Consumer Deployment Working Group (CDWG), Chaired by Max Hata, NTT DOCOMO
Dec 15, 2022

2. 2 © FIDO Alliance 2022
Adding a security key with a screen reader

3. 3 © FIDO Alliance 2022
Agenda 01 Why Accessibility Matters
02 Screen Reader Demo
03 Potential Barriers in Authentication for Users with Disabilities
04 Legal Framework for Accessible Authentication
05 Current Models of Accessible FIDO Authentication
06 Q&A

4. 4 © FIDO Alliance 2022
4 © FIDO Alliance 2021
Why Accessibility Matters?

5. 5 © FIDO Alliance 2022
16%
World’s population experience significant disability.
Source: World Health Organization

6. 6 © FIDO Alliance 2022
1.3 billion
World’s population experience significant disability.
Source: World Health Organization

7. 7 © FIDO Alliance 2022
1 in 6
World’s population experience significant disability.
Source: World Health Organization

8. 8 © FIDO Alliance 2022
Disability is a mismatch between
the person and their environment.

9. 9 © FIDO Alliance 2022
Cognitive &
Learning
Difficultyreading
Difficultywriting
Memory loss
Following plans
Staying focused
Mental disorders
Neurodivergence
Speech &
Language
Speech loss
Speaking loud enough
Being understood
Focusing on speaker
Understanding language
Physical
Limb loss
Weakness
Limited reach
Tremor or Palsy
Holding things steadily
Getting tired quickly
Vision
Blindness
Low vision
Visual field loss
Color blindness
Loss of depth perception
Hearing
Deafness
Muffled sounds
Hearing with one ear
Other sounds get in the way

10. 10 © FIDO Alliance 2022
Cognitive &
Learning
Spelling Check
Grammar Check
Simplified Language
Simplified Workflow
Less Visual Density
Prompts
Notifications
Speech &
Language
AAC Device / Software
Speech Synthesis
Physical
Switches & Sensors
Keyboards
Alternative Input Devices
Voice Control
Macros/Shortcuts
Eye-Gaze
Vision
Font Resizing
Magnification
High Contrast
Color Filters
Shapes & Symbols
Screen Readers
Text-to-Speech
Audio Description
Hearing
Real-Time Text
Sound Amplification
Mono Audio
Captions
Visual alerts
Text chat
Video Calling (ASL)
Assistive Technology

11. 11 © FIDO Alliance 2022
11 © FIDO Alliance 2021
Screen Reader Demo by Joyce

12. 12 © FIDO Alliance 2022

13. 13 © FIDO Alliance 2022
Navigating with a screen reader

14. 14 © FIDO Alliance 2022
Accessible form

15. 15 © FIDO Alliance 2022
Accessible FIDO ceremony

16. Potential Access Barriers in Authentication

17. 17 © FIDO Alliance 2022
Visual
· Entering password if UI is not fully accessible (e.g. missing labels, not
keyboard controllable)
· Vulnerable to shoulder-surfing or peeping
· Eye conditions (e.g. cataracts, macular degeneration) affecting iris or
retinal recognition
· Positioning for facial recognition
· Reading a one-time code on a small, non-backlit display

18. 18 © FIDO Alliance 2022
Physical
· Any method that relies on moving a mouse, pen, or finger steadily
· Reaching or accurately targeting small security keys or keys with
small or depressed active touch areas
· Typing on a keyboard, drawing a pattern
· Manipulating a token, inserting a security key
· Longer transaction time – susceptible to shoulder surfing or peeping
· Biometric scan due to loss of physiological characteristics (e.g. digit
amputation, disease preventing development of fingerprints)
· Fingerprint scan due to dry skin

19. 19 © FIDO Alliance 2022
Cognitive & Learning
· Remembering passwords / challenge-response / pattern gestures
· Understanding and following multiple steps of setting up / changing
passwords
· Having issues with social judgement, gullibility, a lack of awareness –
susceptible to fraud and exploitation

20. 20 © FIDO Alliance 2022
Hearing
· Challenge-response where challenge is presented in audio form
· Voice/speaker recognition

21. 21 © FIDO Alliance 2022
Speech & Language
· Voice/speaker recognition

22. 22 © FIDO Alliance 2022
Mapping Between Auth Methods & Disabilities

23. Legal Framework for Accessible Authentication

24. 24 © FIDO Alliance 2022
27%
* Of the constitutions of the 193 UN member states guarantee equality or nondiscrimination on the basis of disability.
* Derived from data obtained from World Policy Analysis Center.

25. 25 © FIDO Alliance 2022
Global Accessibility Laws
Disability Rights Laws
· Americans with Disabilities Act
· European Accessibility Act
· Accessible Canada Act
· …
Public Procurement Standards
· Section 508 of the Rehabilitation Act
· EN 301 549

26. 26 © FIDO Alliance 2022
WCAG
Web Content Accessibility Guidelines
* Widely adopted / referenced
* Adapted to cover various forms thanks to
its technology-agnostic language

27. 27 © FIDO Alliance 2022
Baking In Accessibility
Maintain
Ship
Validate
Develop
Design
Plan
A11y User Research
Gather User Feedback
A11y Backlog Review
A11y Audit
Product Reqs Doc
A11y Design Specs
UX/UI Mocks
A11y Design Systems
PwD User Stories
QA Testing
A11y Framework &
Components
Research Validation
User Studies
Internal Testing
A11y Expert Review
A11y Readiness Review A11y QA Smoke Test
A11y User Support
A11y Bug Report

28. 28 © FIDO Alliance 2022
WCAG 3.3.7 Accessible Authentication
· New guideline proposed for WCAG 2.2
A cognitive function test (such as remembering a password or solving a puzzle) is not required for any
step in an authentication process unless that step provides at least one of the following:
• Alternative – another authentication method that does not rely on a cognitive function test
• Mechanism – a mechanism is available to assist the user in completing the cognitive function test
• Object Recognition – the cognitive function test is to recognize objects
• Personal Content – the cognitive function test is to identify non-text content the user provided
A task that requires the user to remember,
manipulate, or transcribe information
· Examples of sufficient techniques
· Allow for password managers
· Allow for copying/pasting passwords
· Email link authentication
· Use WebAuthn
· Use OAuth
· Use two techniques to provide 2FA

29. Current Models of Accessible FIDO Authentication
Accessible Deployment of WebAuthn and UAF

30. 30 © FIDO Alliance 2022
WebAuthn – Responsibility Model & Accessible Deployment
Users User Agents RP’s Apps incl. Auth
Users choose user agents supporting
authenticators they are able to use.
User agent developers ensure
compatibility between user agents
and WebAuthn.
RPs ensure applications are compatible with
user agents that support WebAuthn.
RPs create accessible UX.
RPs conform to WCAG 3.3.7.
When providing hardware, RPs enable users
to choose authenticators accessible to them.
If no option is accessible, provide alternative
authentication means.

31. 31 © FIDO Alliance 2022
UAF – Responsibility Model & Accessible Deployment
RPs should adopt the following recommendations for UAF policy control:
1. Mobile apps should always allow phone-unlocking authentication as an option.
2. Mobile apps should allow silent authentication as much as is feasible.
3. Phone-unlocking authentication should be allowed as a fallback/substitute for less secure
modalities.
4. When the mobile app requires one biometric authentication, the mobile app must provide two or
more biometric options requiring different physiological characteristics.
5. When the mobile app requires more than one (N) biometric authentication modality, the mobile
app must provide at least N+1 biometric options requiring different physiological characteristics.

32. 32 © FIDO Alliance 2022
Principles of Deploying Accessible Authentications
Principle #1: RPs should design and implement authentication user
interfaces and training materials to meet WCAG (Web Content
Accessibility Guidelines) Level AA. Conduct user testing with users
with various types and degrees of disabilities.
Rationale: RPs can make user interfaces before, during, and after the authentication
process more accessible by meeting WCAG Level AA and by engaging users with
disabilities in user testing.

33. 33 © FIDO Alliance 2022
Principles of Deploying Accessible Authentications
Principle #2: When implementing WebAuthn, RPs should not
discriminate based on authentication modalities. Non-discriminating
WebAuthn would automatically pass WCAG 3.3.7 Accessible
Authentication.
Rationale: As described in the WebAuthn Responsibility Model, the onus is on end
users to choose user agents with authenticators they are able to use, and the onus is
on user agent developers and WebAuthn working group to ensure compatibility
between user agents and WebAuthn. An RP’s responsibility in implementing
WebAuthn is to ensure WebAuthn does not discriminate based on authentication
modalities.

34. 34 © FIDO Alliance 2022
Principles of Deploying Accessible Authentications
Principle #3: When implementing UAF, RPs should comply with the
guidelines described in the UAF Responsibility Model.
Rationale: RPs are able to choose which authentication modalities are provided via
UAF and allow users to choose modalities. Given the extra flexibility, RPs should take
some important factors into considerations, including the use of phone-unlocking
authenticator as fallback, the use of silent authentication, and requiring one or more
than one modalities of biometric authentication.

35. 35 © FIDO Alliance 2022
FIDO UI Kit
Accessible components
· Accordion
· Animations
· Buttons
· Checkbox
· Form Fields
· Iconography
· Illustrations
· Journeys

36. Call to Action

37. 37 © FIDO Alliance 2022
· Start the conversation
· Test accessibility by experts
· Test accessibility with users with disabilities
· Refer to the White Paper
· Legal framework for accessible authentication
· Accessible deployment of WebAuthn and UAF
· Accessibility training
· IAAP (International Association of Accessibility Professionals)
· Section 508 Trusted Tester
· W3C Accessibility Training Resources

38. 38 © FIDO Alliance 2021
Thank You!