3.3.9: Accessible Authentication (Enhanced)

What it means

At AAA, authentication must not rely on cognitive function tests at all — including object recognition CAPTCHAs and memorised secrets without an alternative. Prefer possession-based or biometrics with user consent.

Remove CAPTCHA-only paths where possible.

How to fix it

• Use passkeys, hardware keys, or magic links instead of recall-based login.
• Eliminate image CAPTCHAs or provide fully accessible non-CAPTCHA login.
• Allow credential manager and SSO for all authentication flows.
• Review third-party auth widgets for hidden cognitive tests.

Quick examples

• Good: Account access uses WebAuthn with no puzzle step.
• Bad: The only login option is a CAPTCHA grid of traffic lights.
• Good: Enterprise SSO removes per-site password memory requirements.
• Bad: Recovery requires naming favourite teachers and childhood streets.