Accessible Authentication

The normative text of SC 3.3.8 says "A cognitive function test ... is not required for any step in an authentication process unless ..."

There is no mention of a login process in the normative text, yet the Understanding page is entirely devoted to the login process and says the SC does not apply to anything else.

However, it is not uncommon to have further authentication processes when you are already logged in. For instance, every time I add a new recipient to my bank account, I have to go through an authentication process. I sometimes have to when making payments, if they are outside some parameters the bank has set. According to the normative text, the SC would apply to these processes, but according to the Understanding page, it doesn't.

I'm not sure if I have a question or if I just need to have a rant about the bad wording. Again. What is the point of normative text if its meaning can be changed so substantially by the non-normative Understanding page? If the SC was only supposed to apply to login pages, why doesn't it say so in the normative text? It would only have added three or four words.

Didn't anyone (including me) notice this during the lengthy review period? Or did the wording change late in the process?

Regards,
Steve Green
Managing Director
Test Partners Ltd
020 3002 4176 (direct)
0800 612 2780 (switchboard)
07957 246 276 (mobile)
020 7692 5517 (fax)
Skype: testpartners
steve.green@testpartners.co.uk
www.testpartners.co.uk
 
Connect to me on LinkedIn - http://uk.linkedin.com/in/stevegreen2

Received on Monday, 13 November 2023 19:21:37 UTC