Authentication barrier

So I just tried to log into my bank which I do very rarely and the have 
switched to a scheme where you need to enter and subset of characters 
from a password. Eg 2, 5 and 10th character

In my fuzzy state today I found this difficult. As Jamie mention short 
term memory issues I wonder if that would be impossible without writing 
it down an putting the numbers underneath? Obviously a complete security 
failure!

I suggest we consider specifically calling it out calling it out in the 
"Logging in does not rely on good memory or other cognitive skills" Pattern?

Perhaps change
   "memorizing character strings,"
to
  "memorizing character strings or a subset identified by character 
position"

Steve

Received on Wednesday, 30 January 2019 13:19:16 UTC