- Success Criterion 3.3.8
- Conformance level AA
Security Question Requiring an Exact Memorized Answer
3.3.8 — Accessible Authentication (Minimum)
Scenario
Setting
A ride-hailing app's trip booking screen
What’s wrong
Security questions demanding recalled exact strings as the only second factor with no alternative (memorization test).
Example
A ride-hailing app's trip booking screen is a good example: security questions demanding recalled exact strings as the only second factor with no alternative (memorization test).
Why it matters
People with cognitive disabilities and anyone who depends on password managers or paste. On a ride-hailing app's trip booking screen specifically, they are blocked from using a password manager.
How to test
Check whether a security question demanding an exact recalled answer is the only second factor: if there's no non-memory-based alternative, it fails.
How to fix
Login must work with paste and password managers — any cognitive test must have a non-cognitive alternative method.
Outcome
Fixed, a visitor to a ride-hailing app's trip booking screen can use their password manager as normal.
Who is affected
People with cognitive disabilities and anyone who depends on password managers or paste.
Learn more
- Understanding Understanding document (opens in a new tab)
Related scenarios
- Password Field That Blocks Pasting or Splits the Code Up
- Password Field Scripted to Block Paste Entirely
- Password Manager Autofill Blocked by the Login Form
- Visual CAPTCHA Required With No Non-Visual Alternative
- Puzzle CAPTCHA Gating Login With No Alternative Method
- One-Time Code Split Into Boxes That Reject a Pasted Code