4

I'm working on the login and login creation of a secured website.

It's the kind of login where a keypad is displayed, all the numbers are in a random order and you need to click on them.

(ugly) example : enter image description here

My question is : Is there a way of making this accessible? Or should there be an accessible mode where users can type their pin code using their keyboard's numbers?

  • I'm confused by the example, probably because my French is limited. Am I right in understanding that they are being asked to type their username and then click the numbers in the grid to enter their PIN/passcode? – Matt Obee Dec 12 '17 at 11:52
  • Yes, absolutely. Is it a French thing? Have you never seen this before? It's supposed to make authentification more secured. – Raphaëlle M Dec 12 '17 at 14:57
  • I don't think I've ever seen this, but that's just me. Not on the web, anyway. It reminds me of something I once saw in a movie, where a physical door lock had a keypad that would randomise each time. – Matt Obee Dec 12 '17 at 15:34
  • I curious as to what the intended security benefit is? I mean it's just the numbers 0-9, how is having them jumbled in a grid more secure than having them in a straight line, or not having them at all and letting the user type it? – DasBeasto Dec 12 '17 at 16:22
  • 1
    If a program is spying on your typing, you should not be using that computer. – user67695 Dec 12 '17 at 17:33
1

From an accessibility point of view, the randomised grid of numbers is likely to be a significant barrier for several groups of users, particularly those using screen readers and braille displays, and those with cognitive disabilities.

For those using a screen reader or braille display, the first challenge woudld be communicating what they need to do. However, the process of actually navigating forward and backward through that grid to find and select the right numbers in the right order, remembering what you've selected so far, sounds like quite a challenge.

Similarly, for those with cognitive disabilities, explaining the concept and the instructions, and then providing positive and negative feeback while they attempt the task, might be difficult.

In short, it would be wise to provide an easier alternative. But of course if you are able to provide an easier alternative, why have the complicated version at all?

  • 1
    I totally agree with you. If we provide an alternative, then there is no point in having this grid in the first place. The thing is, all French banks use this, so there is a reason behind this. I'm trying to figure out whether it can be made accessible, somehow. – Raphaëlle M Dec 12 '17 at 16:38
  • 1
    I would ask the French banks how they serve their blind users. Use whatever that is. – user67695 Dec 12 '17 at 18:08
1

Do not prevent users from using the keyboard.

The most obvious reason being accessibility: keyboard-only users will not just have a tough time logging in, they will not be able to at all.

I myself have difficulty with fine-motor coordination, and Fitts's Law is a serious consideration for me. I would find it very difficult to use this, even though I am capable of and do use a mouse.

This shouldn't be a "mode", this should just be the default: this doesn't make login more secure if the input device is a mouse. It only makes it more secure if the input mode is a touch device that leaves fingerprint. That is the purpose behind randomizing the location of the inputs: an attacker can't take your phone/keypad and figure out that your code must be 1 2 3 4 because there are lots of fingerprint smears where those numbers are, or the numbers on a physical keyboad are worn.

Otherwise, it's misguided security theatre and puts up another barrier for absolutely no reason.

Applying the same logic to an alpha-numeric keyboard, one could require that users use an on-screen keyboard to enter their password and randomize the position of the letters every time. What would that do? Only cause a huge spike in account locks and password resets.

  • I'm not a technical person, but I understand that it is more secure than entering a number with your keyboard. A programme installed on one's computer could catch one's password if entered with the keyboard. This special grid uses randomized images of numbers which makes it impossible for a programme to know which number you've selected. I agree that it's terrible in terms of accessibility. I'm trying to figure out what I can recommend considering all French banks use this... – Raphaëlle M Dec 12 '17 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.