Cross domain complexity, was: Accessible Authentication and issue responses

From: "White, Jason J"

> It is very disappointing that the working group was unable to analyze the accessibility problem

> and to define carefully a solution that addressed the substantive concerns which were raised,



I think that is unfair, the problem was defined, and IMHO the issue was the working group understanding what solutions work in that context.



I spent a lot of time working through that, and there are feasible solutions (with the caveat about WebAuthN). Having to go through that multiple times with everyone, pretty much individually, is not feasible though.



Security (like accessibility) is a complex area, so the combination is very complex. In a situation where anyone can raise a concern, even if the concern is not valid, it makes progress very difficult.



If & when we hit this type of issue in future, I think we need to:

  *   Ensure reasonable solutions are available earlier in the process, and flesh those out more fully. In this case some people with developer-type knowledge would have needed to work with COGA earlier.
(This would have forced the password-manager use aspect earlier, so there would have been less changes later.)

  *   Delegate to an expert sub-group to report back on the solutions. E.g. The sub-group would need a combination of subject-matter experts (COGA and security) and general web-dev knowledge.

  *   Have a point to ask and answer questions, resolve the feasibility issues in one go.



Otherwise it feels like doing a 1000m of hurdles, where you go through the same questions again and again.



Cheers,



-Alastair