Accessibility

[TechnologyClassroom]

Many traditional CAPTCHAs are difficult for people that have trouble with sight. What is the best CAPTCHA alternative to use with accessibility in mind?

[hrj]

We are pretty much clueless about how to improve Accessibility, but would welcome ideas from others.

There are two levels at which we can address this:

1. At the CAPTCHA level: what color choices could be made, alternatives to images, such as audio CAPTCHAs, etc.
2. At the framework level, we might have to make changes for supporting the above. The framework is already quite flexible in terms of content type. We store the CAPTCHA challenge as a blob, and this blob could contain an audio sample just as easily as an image. However, we haven't really tested this, so there might be areas for improvement.

[TechnologyClassroom]

Traditional CAPTCHAs would typically provide an alternative which would be at the framework level. It would essentially say, "Tell me what this jarbled message says. If you cannot read it reload a new jarbled message or try this audio CAPTCHA." The first alternative options allows for reading problems within the CAPTCHA such as an 'n' that could be an 'r' or an 'h' depending on the effect applied to it. The second alternative allows for problems with sight in general.

Another approach with accessibility first is what was proposed by Friendly Captcha where it puts your computer to work for a moment which would slow down automated attacks. PoC here: https://github.com/FriendlyCaptcha/friendly-pow Something like this could be an alternative if sight and audio are an issue.

[hrj]

Those are excellent ideas, thanks! The interaction (choosing between different CAPTCHA types) needs to be done on the application side and our framework's API should be able to support the application in this.

For example, an application could be designed to:

1. Request an image challenge from our API
2. Present an option to the user to

• Enter the solution for the image CAPTCHA
• Get a new image challenge
• Hear an audio challenge
• Use POW

3. Based on the user choice:

• POST solution to our answer API or
• GET another image challenge or
• GET another challenge but with content type == audio
• Run the POW code and submit the result to friendly-pow

We should provide at least one sample implementation of an Audio CAPTCHA.

And perhaps we should create a demo application that ties all this together.

cc @rr83019

[hrj]

Apart from audio, we could also add a text based sample. The advantage being that visually impaired readers could use a text-reader to understand the challenge.

An example text challenge could be,
7 is a ___ number? Your Choices: "even", "odd", "prime", "irrational"
(both "prime" and "odd" could be valid answers even though odd is grammatically not right)

or

Write "x73dfg" in reverse