The Hidden Barrier?
Accessible authentication is the answer.
I just had to authenticate on a portal where the authentication method, the dreaded ‘pick all pictures with traffic lights’, was used. Why dreaded. I have a severe vision impairment. Everything is a blur for me. So I look for the puzzle that uses sounds. Ok. This will work. Not. The words are distorted with a lot of background noise. There is not enough difference between foreground and background to make it easy to do.
This is a common problem for people with disabilities, whether it is a person with low muscle tone who struggles to solve the puzzle due to slow keyboard or mouse usage. The person who has a cognitive impairment, dyslexia, or a vision or hearing impairment. The elderly also struggle. Like many digital solutions, it has not been considered that people with disabilities will also access the function.
We do need to prove who we are online. Logging into a bank account, accessing government services, booking medical appointments, checking email, or signing in at work all require authentication. For many people, this step is invisible and quick. For people with disabilities, it can be a complete barrier.
When people are locked out of essential services is not just inconvenient. It affects independence, privacy, employment, health, and equal participation in society.
See the Australian Government Human Rights Commission for more information for information related to Digital Accessibility Standards.
What is Authentication?
Authentication is the process used to confirm that you are the right person. Common examples include:
- Entering a password
- Receiving a code by text message
- Solving a visual or audio challenge
- Using a fingerprint or face scan
These methods are often designed without considering people with disabilities. As a result, many common authentication systems are difficult or impossible to usefor many.
Authentication barriers affect many groups, often at the same time. What are the barriers?
Vision Impaired People
- Visual challenges that rely on seeing distorted text or images cannot be accessed with screen readers.
- Time-limited codes may expire before a screen reader user can navigate to the input field.
- Apps that block copy and paste force users to retype long codes, increasing errors.
- QR codes without alternatives are unusable without sight.
People Who Are Deaf or Hard of Hearing
- Audio-only challenges cannot be used.
- Voice call verification without text alternatives excludes users who rely on text.
People With Physical Disability
- Small buttons, short time limits, or gestures that require precision are difficult to use.
- Requiring a phone to be held in a certain way for biometrics can be impossible for some users.
- Authentication systems that block assistive technology can prevent access entirely.
People With Cognitive Disability
- Complex password rules are hard to remember.
- Multi-step authentication with unclear instructions increases confusion.
- Unexpected time pressure causes stress and failure.
- Error messages often do not explain what went wrong or how to fix it.
People With Multiple Disabilities
Many people experience more than one disability. A system that offers only one authentication method can exclude someone completely.
Web Content Accessibility Guidelines (WCAG) Standards
The Web Content Accessibility Guidelines set the standard for accessible digital content. Inaccessible authentication often fails these requirements.
Common failures include:
- Requiring sensory ability. Authentication that depends only on vision, hearing, or speech fails requirements that content must not rely on one sense alone.
- Blocking assistive technology. Systems that prevent screen readers, password managers, or alternative input methods from working fail compatibility requirements.
- Time limits without control. Short time limits that cannot be adjusted fail requirements for users who need more time.
- Overly complex tasks. Authentication that requires remembering complex information or solving puzzles fails requirements for cognitive accessibility.
- No accessible alternative. When only one method is provided, and it is inaccessible, the system fails basic accessibility principles.
WCAG is clear: users must be able to authenticate without unnecessary barriers, and alternatives must be provided. See WCAG 3.3.8 for more information.
Human rights?
Authentication is often the gateway to essential services. When it is inaccessible, people with disabilities are denied equal access to:
- Government services
- Healthcare
- Banking and finance
- Employment systems
- Education platforms
This creates discrimination by design. If a person cannot log in independently, they may be forced to share passwords or rely on others, putting privacy and security at risk.
Possible Solutions
Accessible authentication is possible. It requires choice, flexibility, and respect for different needs.
Here are better options.
Provide Multiple Authentication Methods
No single method works for everyone. Offering more than one option allows people to choose what works best for them.
Examples include:
- Password plus an accessible one-time code
- Email link authentication
- App-based approval that works with screen readers
Allow Password Managers and Assistive Technology
Blocking copy and paste or password managers creates barriers without improving security. These tools often make accounts more secure and more accessible.
Use Biometrics Carefully
Biometrics can be helpful for some people; however, it must never be the only option. Always provide an alternative that does not require physical interaction or specific movements.
Remove Unnecessary Challenges
Visual and audio challenges should be avoided where possible. If used, they must have accessible alternatives that do not rely on sight or hearing.
Give Users Control Over Time
Allow users to extend time limits or request a new code without penalty. Do not force users to start again from the beginning.
Use Clear Instructions and Errors
Explain each step in plain language. If something goes wrong, tell the user what happened and how to fix it.
Finally
Benefits for Everyone
Accessible authentication does not weaken security. It improves it. When systems are clear, flexible, and usable, people make fewer mistakes, rely less on workarounds, decrease frustration and stress, and protect their information better.
Most importantly, accessible authentication respects independence, dignity, and equality.
If people cannot get past the login screen, everything else is irrelevant. So the question is simple: if authentication is the front door to digital services, who are we still locking out?