Accessible Authentication (Enhanced)

pass.html — the fix

<h1>Sign in</h1>

<!-- FIX 1: a passkey. The user proves who they are with their device -
     fingerprint, face, or a hardware key. Nothing is recalled, transcribed or
     solved, so there is no cognitive function test at any point. This is the
     cleanest way to satisfy 3.3.9, and it is also more secure than a password. -->
<div class="opt">
  <h2>Sign in with a passkey</h2>
  <p>Use your device's fingerprint, face recognition or security key. Nothing to
     remember and nothing to type.</p>
  <button type="button" class="button">Continue with a passkey</button>
</div>

<!-- FIX 2: a one-time sign-in link by email. The user clicks a link; they do
     not transcribe a code, which would itself be a cognitive function test
     unless it can be pasted. -->
<div class="opt">
  <h2>Sign in with an email link</h2>
  <p>We will email you a link that signs you in. No password, no code to copy.</p>
  <div class="field">
    <label for="e">Email address</label>
    <input type="email" id="e" autocomplete="username">
  </div>
  <button type="button" class="button button--secondary">Email me a sign-in link</button>
</div>

<!-- FIX 3: the password route remains for people who prefer it, with paste
     allowed and correct autocomplete tokens so a password manager does the
     remembering. Keeping this option is important: removing choice is its own
     accessibility problem. -->
<div class="opt">
  <h2>Sign in with a password</h2>
  <div class="field">
    <label for="u">Email address</label>
    <input type="email" id="u" autocomplete="username">
  </div>
  <div class="field">
    <label for="p">Password</label>
    <input type="password" id="p" autocomplete="current-password">
  </div>
  <button type="submit" class="button">Sign in</button>
</div>

<!-- No CAPTCHA of any kind. Where you need bot protection without a cognitive
     function test: server-side risk scoring, rate limiting, proof-of-work
     challenges the browser solves invisibly, or a hardware factor.

     How the two criteria differ:
       3.3.8 (AA)  no cognitive function test, EXCEPT object recognition or
                   identifying non-text content the user provided
       3.3.9 (AAA) no cognitive function test, no exceptions

     And remember what 3.3.8 already establishes: "remember your password" IS a
     cognitive function test. It is only permitted at AA because password
     managers exist - which is precisely why blocking paste breaks conformance. -->