Open mraccess77 opened 6 years ago
Perhaps we should clarify that multi-factor authentication need not require multiple computing devices to be used. For example, my ssh key (something I have) and the pass phrase used to unlock it (something I know) amount to multi-factor authentication, if I understand correctly, but do not require more than one computer. The same is true, for instance, of an RSA SecureID soft token, or TOTP authentication - where the one-time codes can be generated on the same device used for log-in.
multi-device authentication is common in China Internet environment, such as someone need to pay money to merchant on Web/App, the customer transaction interface ask customer to input "the code of mobile authentication", customer press "send" button, will have a code be sent to customer phone, then input the code, the transaction will be completed.
Problem is someone have no phone, or the area without mobile signal, it will be awkward. Beyond that, this is an accessible way for CAPTCHA.
Video-game CAPTCHAs also provide a barrier to people with repetitive strain injury or other hand mobility impairments. Or for that matter, people who don't enjoy playing video games.
The video game CAPTCHA would require some level of accessibility for assistive technology like screen readers and still pose issues for some users with cognitive and learning disabilities. Any accessibility added for screen readers may in turn provide a back door for bots to use to solve the CAPTCHA.
While multi-device authentication sounds great for some in the developed world -- access to multiple devices is not a given even in the US. There are people without smartphones and in many parts of the world a single mobile device is how people access the Internet. These considerations should be documented in the document as there are real challenges and more exploration that must be done in these areas.