Accessible Authentication (Enhanced)
A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides an alternative authentication method that does not rely on a cognitive function test, or a mechanism is available to assist the user in completing the cognitive function test.
In plain language
This is a stricter version of the login rule above: no authentication step can require someone to "memorize and figure it out on their own" — not even tasks like "pick the photos with a car in them." There must always be an alternative that doesn't depend on memory or reasoning, like biometrics or a support mechanism.
Why it matters
Tests like "memorize a password" or "recognize objects in images" (CAPTCHA-style) exclude people with cognitive, memory, or learning disabilities, even when some kind of "help" exists. This stricter version guarantees there's always a login path that doesn't depend on that kind of mental effort.
In practice
Fails this criterion
To confirm identity, the site asks the user to select all the images containing a car (CAPTCHA-style), with no alternative login method available.
Meets this criterion
The site lets people sign in using their fingerprint or face recognition on their phone or computer, or accepts a password manager with auto-fill — never requiring the person to memorize or solve something on their own.
Test it yourself
Go through the site's login and identity-verification flow. If at any point the only option is to "memorize and type" a password or solve a visual test (like picking images), with no alternative (biometrics, password manager, etc.), this criterion is failing.