# Inclusive by design: Developing Barrier-Free Authentication for Blind and Low Vision Users through the ALIAS Project

Clara Toussaint, Benjamin Chateau, Pierre-Guillaume Gourio-Jewell, Émilie

Bonnefoy, Nicolas Louveton

► To cite this version:

Clara Toussaint, Benjamin Chateau, Pierre-Guillaume Gourio-Jewell, Émilie Bonnefoy, Nicolas Louveton. Inclusive by design: Developing Barrier-Free Authentication for Blind and Low Vision Users through the ALIAS Project. 36th Annual Conference of the European Association of Cognitive Informatics (EACE): Critical reflection for a better tomorrow, European Association of Cognitive Informatics (EACE), Oct 2025, Tallin, Estonia. 10.1145/3746175.3746210. hal-05244343

HAL Id: hal-05244343

https://hal.science/hal-05244343v1

Submitted on 11 Sep 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Inclusive by design: Developing Barrier-Free Authentication for
Blind and Low Vision Users through the ALIAS Project

Clara Toussaint

CeRCA, Université de Poitiers,
Université François-Rabelais de Tours,
CNRS

Poitiers, France

clara.toussaint@univ-poitiers.fr

Benjamin Chateau

CeRCA, Université de Poitiers,
Université François-Rabelais de Tours,
CNRS

Poitiers, France

benjamin.chateau@univ-poitiers.fr

Pierre-Guillaume Gourio-Jewell

OpenSezam, France
Toulon, France

pierre-guillaume.gourio-jewell@opensezam.com

Emilie Bonnefoy

OpenSezam, France
Longjumeau, France

emilie.bonnefoy@opensezam.com

Nicolas Louveton

CeRCA, Université de Poitiers,
Université François-Rabelais de Tours,
CNRS

Poitiers, France

nicolas.louveton@univ-poitiers.fr

Abstract

Authentication is the cornerstone of information security in our daily lives. However, disabled users such as Blind and Low-Vision (BLV) ones are left behind in digital services due to the lack of accessibility. According to the World Health Organization, 36 million people are blind worldwide. It is estimated that there will be 115 million by 2050, due to the ageing of the population. Yet accessing digital services has become increasingly essential. At the same time, cyber threats targeting individuals have also increased strongly in the last few years. The ALIAS project addresses the need for accessible digital authentication solutions for BLV users facing challenges with digital technology. Security systems can inhibit access for these individuals as they become more complex. This project aims to create a barrier-free authentication system based on cognitive ergonomics and user experience (UX) design methods specifically for BLV users. This paper presents an overview of current research in this area. We also identify research gaps, and finally, we present our project's methodology and approach. First, we will build a knowledge base on the digital practices and cognitive models of BLV users during authentication. This information will support the development of prototypes, which will be tested and refined through two iterations before finalizing the operational version.

CCS Concepts

* Human-centered computing → Accessibility design and evaluation methods; User centered design; * Security and privacy → Usability in security and privacy; Biometrics; Multi-factor authentication; Privacy protections.

<figure><img src="image_2.png" /></figure>

This work is licensed under a Creative Commons Attribution 4.0 International License.
ECCE 2025, Tallinn, Estonia

© 2025 Copyright held by the owner/author(s).
ACM ISBN 979-8-4007-2033-8/25/10
https://doi.org/10.1145/3746175.3746210

Keywords

Accessibility, cybersecurity, blind, low vision, authentication, user-centered design

ACM Reference Format:

Clara Toussaint, Benjamin Chateau, Pierre-Guillaume Gourio-Jewell, Emilie Bonnefoy, and Nicolas Louveton. 2025. Inclusive by design: Developing Barrier-Free Authentication for Blind and Low Vision Users through the ALIAS Project. In *36th Annual Conference of the European Association of Cognitive Ergonomics (EACE) (ECCE 2025), October 07–10, 2025, Tallinn, Estonia*. ACM, New York, NY, USA, 4 pages. https://doi.org/10.1145/3746175.3746210

# 1 Introduction

The web and mobile applications have become the primary channels for delivering content, services, and products to individuals and professionals. However, as malicious activities continue to rise, digital security has become an imperative. Beyond the often technical approach to cybersecurity [20], considering human factors remains a critical component in risk prevention and a significant source of vulnerability [21]. Authentication is a cornerstone of digital security: it must ensure secure access, data confidentiality, and the identification of all system actors.

Yet the growing need for security often results in more complex access to services. This dilemma is clearly articulated by Dourish et al. (p.3) [11]: "Security systems typically seek to introduce barriers to action (such as passwords or other authentication mechanisms), while HMI (Human Machine Interaction) designers attempt to remove those barriers." For example, systems often require users to enter a code received by email or to solve a CAPTCHA <fnref n="1" /> to reinforce security. However, such barriers can be insurmountable for some individuals, especially people with visual impairments. In France, more than one million people are affected by this disability <fnref n="2" />, or nearly 15 out of every 1,000 inhabitants.

The ALIAS (Authentication Liable for Inclusivity and Simplicity) project was launched to address the accessibility challenges in

<footnote n="1">¹Completely Automated Public Turing test to tell Computers and Humans Apart</footnote>

<footnote n="2">²https://drees.solidarites-sante.gouv.fr/publications/etudes-et-resultats/les-personnes-ayant-un-handicap-visuel-les-apports-de-lenquete</footnote>
digital security. According to the Association Valentin Haüy (AVH), which supports individuals with visual impairments, reveals that these people are increasingly connected. AVH states that less than 15% of blind people can read Braille in France<fnref n="3" />, and against all intuition, some even use a tactile smartphone, both to communicate and to overcome their daily difficulties. It is therefore essential to understand their uses and involve them in the design of inclusive security solutions. Our goal is to improve our understanding of how individuals with vision impairments use digital technology, an area that still requires further research for better coverage of challenges and potential solutions. We specifically aim to explore how the lack of accessibility and usability affects these users' perceptions of risk. This knowledge is crucial for developing innovative authentication methods that are both safe and inclusive.

## 2 Authentication usability

Authentication is vital to online services, as it verifies the user's identity and safeguards their data from unauthorised access. Authentication is not part of the user's mental model of the task they want to perform (e.g., making a purchase) and, therefore, they will perceive this step as "a barrier" [11].

Authentication can be defined as follows: "The user identifies himself by sending *x* to the system; the system authenticates their identity by calculating *F*(*x*) and verifying that it is equal to the stored value *y*' [17]. The most common method is the username-password pair. However, the growth of the Internet has led to malicious behavior, pushing services to enforce more complex password requirements.

Passwords have to be difficult to "guess", which makes the authentication process increasingly burdensome in digital activities. Yet, in its list of usability criteria, Nielsen [19] encourages interface designers to rely on recognition (using cues to initiate recall) rather than recall (reconstructing information from scratch).

Depending on the level of expertise, sensitivity, and trust of the user [22, 25], different password management strategies will be observed (see, for example, the table on the vigilance zone, password management [20]) which either go in the direction of a weakening security (use familiar words, customize a base password, keep a paper or electronic list of all passwords [9]), or in that of advanced management (e.g., password manager).

Weak passwords are particularly vulnerable to hacking algorithms (e.g., brute force), which try all possible combinations [5]. This is how CAPTCHAs emerged to counter these methods.

In contrast, biometric solutions such as fingerprint scanning and face recognition stand out for their usability and security. They have the advantage of being "invisible"; they do not require a physical object (a card) or prior knowledge of the user (password) [3]. However, they are not always desirable: they imply user confidence in managing personal data, reliability of recognition, and, ultimately, invisibility itself can be a usability problem (e.g., unintentional unlocking of the smartphone by touching the sensor).

From now on, implementing multi-factor authentication (MFA) is becoming increasingly widespread, primarily due to the simplicity of smartphone integration. This method is more secure, but it

should be noted that it is also more complex for the user, as it adds authentication steps before allowing access to the service.

## 3 Accessibility and authentication

Adding authentication factors is an effective solution for protecting users from cyberattacks. However, some authentication methods can present significant challenges for individuals with conditions affecting their vision, hearing, cognition, or motor capacities, like CAPTCHAs [18]. That is why the challenge should be shifted towards the designers of these systems, to make them more accessible, as recommended by the ISO 9241-171: 2008 standard, to ensure systems are straightforward to use, and thus usable by a wide variety of people with differing abilities. Furthermore, the Web Accessibility Initiative (WAI) promotes web accessibility, establishing standards like WCAG<fnref n="4" /> in the USA and RG2A<fnref n="5" /> in France to ensure the web is usable by all.

We focus on people who are blind or have low vision (hereinafter BLV), as user interfaces generally communicate information visually, particularly during the authentication process. For this reason, BLV users may have to use assistive tools such as screen readers, magnifiers, voice control, or braille terminals for their digital use. It should be noted that such tools do not always preserve privacy, depending on the authentication context.

This is especially true on the mobile platform, mainly due to the ubiquity of touchscreens [12]. Exploring a touchscreen interface for a BLV user can be achieved with the help of assistive tools, which can create a lack of comfort due to potential observers nearby who could easily hear or see what the user is doing. Typing a password on a smartphone is also considered one of the most challenging tasks for a BLV [8]. And can cause discomfort when entered in public [1] or exposed to shoulder surfing [16].

For these reasons, most BLV users do not protect their mobile devices with a password [7, 10]. Even if they consider authentication to be essential or very important (96% on a questionnaire on 325 people) [9].

However, BLV people tend to lower their vigilance concerning their security and digital privacy when surrounded by people close to them; they adopt a transparent approach with their data [2].

Former research has demonstrated that, among authentication methods, iris scans and patterns drawn on the screen are the least accessible, whilst fingerprinting is the most accessible and secure [9]. And although PINs are ubiquitous on mobile, they are perceived as uncomfortable [7] because they impose a significant slowdown in user activity [27]. BLV people also perceive them as the least secure method because they are easy to guess and more vulnerable to shoulder surfing [9].

The authors of this literature review [6] note that additional devices can be used to increase the security and confidentiality of authentication methods, such as braille passwords [4] or digital magnifying glasses [24]. They emphasize the importance of integrating these devices into the daily tools of BLV users [23].

<footnote n="4">⁴https://www.w3.org/WAI/standards-guidelines/wcag/</footnote>

<footnote n="5">⁵https://accessibilite.numerique.gouv.fr</footnote>

<footnote n="3">³https://informations handicap.fr/a--2732.php</footnote>
## 4 Gap in research

Our reviews of the literature indicate that authentication methods generally exhibit low usability, even for typical users. This limitation is exacerbated for individuals with disabilities, particularly BLV users, due to a lack of accessibility. Poor usability and low awareness of cybersecurity risks can lead to increased dependence on others and weakened security when using digital services.

*Future research should focus on two main areas:*

* First, understanding how information security is perceived within the BLV population and how this perception impacts their daily use of digital services. This requires gathering knowledge about the digital equipment and usage of BLV users. Given the limited literature in this domain, this will necessitate conducting user studies with BLV individuals.

* Second, analyzing how advanced authentication technologies could help design more accessible authentication pathways. While accessibility design standards (e.g., ISO/IEC 30071-1:2019) offer practical guidance, they may fall short when applied to breakthrough technologies. Then it would be valuable to rely on a model grounded in cognitive ergonomics. However, existing research on BLV people's mental model mainly focuses on spatial cognition (e.g., [14]) and rarely addresses Human Machine Interaction (HMI). Developing a cognitive model of the digital authentication activity among BLV users could help support more inclusive innovations in cybersecurity.

## 5 ALIAS project framework

The ALIAS project aims to bridge the gap in cybersecurity for BLV individuals. It follows an iterative process based on a user-centered design approach. Indeed, UX involves pragmatic qualities (task efficiency and satisfaction) and hedonic qualities (user emotions and preferences). ISO 9241-210:2019 highlights three key factors for assessing UX: the system, the user, and the context (c.f., Fig. 1). User-Centered Design (UCD) is the best approach to enhance these qualities, using iterative design and humanities methodologies to consider the user's perspective. UCD must involve a diverse user base, including those with disabilities.

<figure><img src="image_3.png" /><figcaption>**Figure 1:** UX key factors as defined by ISO 9241-210:2019. "UX is a consequence of a user's internal state (predispositions, expectations, needs, motivation, mood, etc.), the characteristics of the designed system (e.g., complexity, purpose, usability, functionality, etc.) and the context (or the environment) within which the interaction occurs (e.g., organisational/social setting, meaningfulness of the activity, voluntariness of use, etc.)" [15]</figcaption></figure>

We follow a three-stage approach to adapt these user-centered design requirements to our research project (c.f., Fig. 2). The first stage will study digital service usage and the perceived risks and challenges related to traditional authentication systems. To achieve this, a questionnaire survey made on an accessible platform called Qualtrics (target sample > 300 BLV individuals, as [9]) will be implemented to describe the digital environment of BLV users, particularly in terms of equipment, usage, and reliance on human or technological assistance. The questionnaire will be complemented by focus groups (target sample > 30 BLV individuals) to gather feedback on using authentication services and further explain the questionnaire results. Each focus group consists of two workshops. The first is an experience-sharing session on the use of numeric and cybersecurity, and the second involves a mental simulation of different types of authentication. In order to guarantee the accessibility of focus groups, consent will initially be requested without recording, and subsequently with recording. Visual support, such as images and videos, will not be used. The second workshop will encourage oral description of authentication steps with different models (password, CAPTCHA, magic link, biometrics). The results from this first stage will be used to build a cognitive model of the authentication activity among BLV users, guiding the design team in developing an Alpha version of a more inclusive and acceptable authentication solution.

The second stage will again place BLV users at the center of the process. The goal will be to provide suggestions for improvement, both for developing an Alpha version of the solution and for refining the cognitive model developed in the first stage. These suggestions will be derived from the results of a user test conducted on usable website mock-ups. The test material will be designed to evaluate main authentication systems (username, password, email/SMS code, etc.) as well as a preliminary version of an accessible authentication solution, developed based on Stage 1 findings. Each participant (n=14) will interact with all authentication systems following the Think-Aloud Protocol [13] and will then evaluate each system using a questionnaire [26]. The test materials will be validated beforehand through a focus group (n=4).

The third stage will be identical to the second, aiming to validate the directions taken in the Beta version and provide recommendations for the final version. This time, the tests will focus on two existing websites (one private service and one public service). For each website, users will evaluate an accessible version using conventional authentication, as well as an adapted version integrating the Alpha version of the solution. The experimental protocol and sample sizes will be identical to those used in the second stage.

<figure><img src="image_4.png" /><figcaption>**Figure 2:** ALIAS Project Stages</figcaption></figure>
# 6 Conclusion

Ensuring that our digital world is accessible and secure for all users is increasingly critical in contemporary society. In this context, authentication is a fundamental component of information security. However, it often presents significant barriers for many individuals, particularly those who are blind or visually impaired. The ALIAS project seeks to address this issue using cognitive ergonomics and a user-centered design approach to enhance our knowledge of how risk perception, technology design, and disability interact to lead to unsafe behavior and digital exclusion. Ultimately, the ALIAS project aspires to establish a framework that integrates scientific inquiry, technological advancement, and ethical considerations about technology and security design for all.

# Acknowledgments

This work was supported by a French government grant managed by the French National Research Agency under the France 2030 program, reference ANR-22-PTCC0001.

# References

[1] Tousif Ahmed, Patrick Shaffer, Kay Connelly, David Crandall, and Apu Kapadia. 2016. Addressing physical safety, security, and privacy for people with visual impairments. In *Twelfth Symposium on Usable Privacy and Security (SOUPS 2016)*. 341–354.

[2] Taslima Akter, Bryan Dosono, Tousif Ahmed, Apu Kapadia, and Bryan Semaan. 2020. "I am uncomfortable sharing what I can't see": Privacy Concerns of the Visually Impaired with Camera Based Assistive Applications. In *29th USENIX Security Symposium (USENIX Security 2020)*. 1929–1948.

[3] Ometov Aleksandr, Bezzateev Sergey, Mäkitalo Niko, Andreev Sergey, Mikkonen Tommi, and Koucheryavy Yevgeni. 2018. Multi-factor authentication: A survey. *Cryptography* 2, 1 (2018), 1.

[4] Mrim Alnfiai and Srinivas Sampalli. 2019. BraillePassword: accessible web authentication technique on touchscreen devices. *Journal of Ambient Intelligence and Humanized Computing* 10 (2019), 2375–2391.

[5] Ross Anderson. 2020. *Security Engineering: A Guide to Building Dependable Distributed Systems*. John Wiley & Sons Inc.

[6] Sarah Andrew, Stacey Watson, Tae Oh, and Garreth W Tigwell. 2020. A review of literature on accessibility and authentication techniques. In *Proceedings of the 22nd International ACM SIGACCESS Conference on Computers and Accessibility*. 1–4.

[7] Shiri Azenkot, Kyle Rector, Richard Ladner, and Jacob Wobbrock. 2012. Pass-Chords: secure multi-touch authentication for blind people. In *Proceedings of the 14th international ACM SIGACCESS conference on Computers and accessibility*. 159–166.

[8] Natā M Barbosa, Jordan Hayes, and Yang Wang. 2016. UniPass: design and evaluation of a smart device-based password manager for visually impaired users. In *Proceedings of the 2016 ACM international joint conference on pervasive and ubiquitous computing*. 49–60.

[9] Daniella Briotto Faustino and Audrey Girouard. 2018. Understanding authentication method use on mobile devices by people with vision impairment. In *Proceedings of the 20th International ACM SIGACCESS Conference on Computers and Accessibility*. 217–228.

[10] Bryan Dosono, Jordan Hayes, and Yang Wang. 2015. {"I'm" {Stuck!} }: A Contextual Inquiry of People with Visual Impairments in Authentication. In *Eleventh Symposium On Usable Privacy and Security (SOUPS 2015)*. 151–168.

[11] Paul Dourish, Rebecca E Grinter, Jessica Delgado De La Flor, and Melissa Joseph. 2004. Security in the wild: user strategies for managing security as an everyday, practical problem. *Personal and Ubiquitous Computing* 8 (2004), 391–401.

[12] Cecil D'silva, Vickram Parthasarathy, and Sethuraman N Rao. 2016. Wireless smartphone keyboard for visually challenged users. In *Proceedings of the 2016 Workshop on Wearable Systems and Applications*. 13–17.

[13] K. A. Ericsson and H. A. Simon. 1993. *Protocol Analysis: Verbal Reports as Data (Revised Edition)*. Bradford Books.

[14] João Guerreiro, Daisuke Sato, Dragan Ahmetovic, Eshed Ohn-Bar, Kris M Kitani, and Chieko Asakawa. 2020. Virtual navigation for blind people: Transferring route knowledge to the real-World. *International Journal of Human-Computer Studies* 135 (2020), 102369.

[15] Marc Hassenzahl and Noam Tractinsky. 2006. User experience-a research agenda. *Behaviour & information technology* 25, 2 (2006), 91–97.

[16] Manu Kumar, Tal Garfinkel, Dan Boneh, and Terry Winograd. 2007. Reducing shoulder-surfing by using gaze-based password entry. In *Proceedings of the 3rd symposium on Usable privacy and security*. 13–19.

[17] Leslie Lamport. 1981. Password authentication with insecure communication. *Commun. ACM* 24, 11 (1981), 770–772.

[18] Lourdes Moreno, María González, and Paloma Martínez. 2014. CAPTCHA and Accessibility-Is This the Best We Can Do?.. In *WEBIST (2)*. 115–122.

[19] Jakob Nielsen. 1994. *Usability engineering*. Morgan Kaufmann.

[20] Alessandro Pollini, Tiziana C Callari, Alessandra Tedeschi, Daniele Ruscio, Luca Save, Franco Chiarugi, and Davide Guerri. 2022. Leveraging human factors in cybersecurity: an integrated methodological approach. *Cognition, Technology & Work* 24, 2 (2022), 371–390.

[21] Antesar M Shabut, Khin T Lwin, and M Alamgir Hossain. 2016. Cyber attacks, countermeasures, and protection schemes—A state of the art survey. In *2016 10th International Conference on Software, Knowledge, Information Management & Applications (SKIMA)*. IEEE, 37–44.

[22] Kim Bartel Sheehan. 2002. Toward a typology of Internet users and online privacy concerns. *The information society* 18, 1 (2002), 21–32.

[23] Kristen Shinohara, Cynthia L Bennett, Wanda Pratt, and Jacob O Wobbrock. 2018. Tenets for social accessibility: Towards humanizing disabled people in design. *ACM Transactions on Accessible Computing (TACCESS)* 11, 1 (2018), 1–31.

[24] Lee Stearns, Leah Findlater, and Jon E Froehlich. 2018. Design of an augmented reality magnification aid for low vision users. In *Proceedings of the 20th international ACM SIGACCESS conference on computers and accessibility*. 28–39.

[25] PKI Usable. 2004. In *Search of Usable Security: Five Lessons from the Field*. IEEE SECURITY & PRIVACY (2004).

[26] Viswanath Venkatesh and Hillol Bala. 2008. Technology acceptance model 3 and a research agenda on interventions. *Decision sciences* 39, 2 (2008), 273–315.

[27] Flynn Wolf, Ravi Kuber, and Adam J Aviv. 2018. An empirical study examining the perceptions and behaviours of security-conscious users of mobile authentication. *Behaviour & Information Technology* 37, 4 (2018), 320–334.