Authentication and authorisation for people with intellectual disabilities

Question

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain areas of this web application require identification of the user to allow the content to be aligned with the user's capabilities and to prevent user impersonation. The current version is very outdated and uses a very weak username/password-like authentication mechanism, which boils more or less down to unsecured access (abuse has been detected in the past).

I think some kind of MFA, or MFA-based approach is recommended as a replacement for the username/password solution in place. It could be interesting to have an adult, for example, a parent (when used in a home setting) or a teacher (when used at school), confirm access to the online resources on behalf of the user when the user it not able to authenticate for whatever possible reason.

Because some of the users have (very) limited intellectual capabilities, (more) complex mechanisms (like OTP, mobile authenticator, digipass, etc.) are not always suited. Also because of the age range of the target audience (ranging between 8 and 21), we cannot assume every user has access or is allowed to use a smartphone that could be used in the authentication flow. Under such circumstances, parental approval might be a valid alternative solution.

Many possible approaches probably exist to implement such authentication and authorisation solution. Please feel free to share any thoughts/ideas/suggestions to setup such solution.

Currently, a parent or teacher (guardian) registers a child/adolescent (user) via an online registration procedure. This procedure is email based and assigns a username for the user (based on the first name, last name and date of birth), a 3-letter password (limited to the first 10 characters of the alphabet) for the user and a free text guardian password. Using the website, the guardian uses the username/guardian password to add the user account to the local browser (cookie based). When a user want to authenticate, he/she selects his/her picture/avatar and enters the 3-letter password.

My concerns about this approach are:

1. Adding avatars using a browser cookie to ease future authentication with such a weak password makes authentication pointless.
2. The very limited number of user password combinations possible with 3 characters out of of a set of 10 possibilities makes it very prone to attacks.
3. I find the overall procedure somewhat confusing and not very guardian friendly.

I deliberately did not explicitly mention before that the current solution is a browser based platform to keep as many possibilities open as possible. Interviewing guardians and users, we noticed a more or less even distribution among the desire for web based solutions and native mobile solutions (the latter does not exist today).

Answer 1

Users don't care.

Mental disorder or not users simply don't care as much as you do about security. You could set up two factor, OTP, even physical keys and users will still wander off to the bathroom without locking their computer.

It's important to understand security is about motivation. If you're trying to secure private information the user has entered into the system then the user is motivated to keep it secure.

If you want to ensure a compromised account can't be used to send the president threating emails understand that the user is not only not motivated but most likely completely unaware that their bathroom trip could play a role in this.

Rather than focus on trying to ensure authentication is 100% admit that it's not and that it might be a good idea to limit the ability to use the system in unintended ways, authenticated or not.

As for "mental disorder" this is such a catch all term I'll argue that a better term for them is user. Any system that deals with enough users deals with users with a mental disorder. With a net this wide the only sensible accommodation is allowing for more than one authentication scheme in the hopes of providing one that works for them. I, for example, am dyslexic as hell. So for me, asking for correctly spelled passphrases without benefit of a spell checker is a non-starter. Others will have different issues. The more schemes you allow the more you accommodate.

For what it's worth, I've worked with students who had profound disabilities (or whatever politically correct term du jour) who's ability to use a computer was constrained to pressing one big red button. And I've maintained computer labs used by college students. As far as security goes I trust both groups equally. And not for any politically correct reason.

If you're reading this and thinking I haven't truly answered the question that's because this is a frame challange. I'm calling the basis of the question into question. You don't need to worry about disabled people not maintaining account security because other users don't either. Worry about that.

Answer 2

Two obvious things.

One, there's an inadequate specification of who the security measures need to resist, and/or who stands to gain from unauthorised access. No system is wholly resistant to adversarial attack, and it's impossible here to infer the exact vulnerabilities of the target or the incentives of the adversary. There isn't even the barest of information about why a playground for those lacking mental capacity requires authentication.

Two, there is at least partly an assumption that despite lacking capability in general, the users may still be capable of participating in any scheme to secure access to the computer systems. The existing simple scheme has, you acknowledge, failed. It's important to recognise when do-something-itis is reigning.

Limited mental capacity is often associated with limited individuality, in the same way that children have limited individuality as distinct from adults around them (and especially, their parents).

What I mean by individuality is possibly something corresponding to the "homo economicus" model of behaviour in economics, in which "individuals" have intentions and preferences which arise from within (not from outside), their interests are in behaving in ways which express those intentions or meet those preferences, and their capability is such as to be able to analyse their circumstances and align their behaviour to their interests.

The designers of computer authentication systems often assume individuality, and assume that access to a computer can always be related to an individual. Or more precisely, they usually want to assume these things, because such assumptions if fulfilled would enable the computer system to be used or accessed in ways it couldn't otherwise.

In fact, these assumptions are likely to be most strongly challenged by those with limited mental capacity. They may struggle to recall and reliably execute complicated schemes of behaviour (which, despite its complexity, is commonplance and well-trained amongst capable adults, and therefore not generally seen as difficult). They may be deferential in general to others, or to those they recognise as responsible adults - this deference is often encouraged, to allow responsible adults to manage them. And they may be eager to please, or struggle to conceive or scrutinise the propriety of fulfilling requests or aligning with intentions expressed by others. Their lives may be sheltered, leading to an under-developed common sense.

What this adds up to is that it is almost certainly a fundamental mistake to design a computer system for those with limited mental capacity, including an authentication scheme, around the assumption of their individuality.

Behind those with limited mental capacity, are their supervisors who often have considerable influence. Often, the supervisor might not be a specific adult, but a varying set of them. Beyond this, friends and peers, and even downright strangers, may have considerable influence (in a way which, for a person with normal mental capacity, would be considered blameworthy and a failure of responsibility).

And then the person with limited capacity may themselves behave on their own initiative in absurd or irresponsible ways, but which is characteristic of their condition.

Under these circumstances, any real security is impossible when it attempts to treat the typical person with limited mental capability as an individual, and it should be assumed that all information in a computer system which such a person can access, is community property.

Answer 3

Conundrum

The combination of potentially low-qualified users and diverse and potentially insecure hardware environments makes this a hard problem to solve, and probably one where the solution isn't a simple strategy someone could write down.

Two-factor schemes are complex or expensive or both

Typically, MFA schemes depend on a combination of something the user knows and something the user has, for example, a memorized password plus a TOTP key generator. This requires that the user is able to memorize a short string and is able to type it reliably, and that they are able to read and type something like a 6-digit number.

From your list of requirements, you have already excluded OTP, Smartphones, etc. But you will need to bite the bullet and require something that isn't a memorized password.

If you can depend on a a set of always available hardware features, such as a standard USB port, most likely a hardware USB token might be the right choice. This is costly, though. NFC reader hardware isn't ubiquitous, so NFC tokens, which can be pretty cheap, are likely out.

A completely different line of thought

What can you possibly change or limit in your requirements?

• One option you already mentioned is requiring the assistance of a helper who is able to execute a more complex authentication scheme. This would enable you to strike out the condition that the scheme must be usable by the target user.
• You could evaluate what is actually at stake, why someone would want to access the account with stolen authentication, how they were able to gain access to the password, etc., and protect against the known vulnerabilities. If you need to protect private data, you might require different authentication for that than for access to the user-facing web application.

Answer 4

Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with mental disorders.

For simplicity, let's omit whether there's a disorder or not. The problem to solve is the "dependency". I think the error is in looking for solutions based on "autonomy". Our target users probably don't have much autonomy in their real life so, the solution should take this into account.

This's not a problem exclusive to users with mental disorders, it's also a problem among our elders. We are speaking about a group of users who often depends (a lot) on someone else, so the security must involve the capacity to trust in that someone else. Someone who is not the immediate benefactor.

In this context, we must assume the solution will be susceptible to abuses. Technology aside, it will be critical to implement a protocol (process) to follow in case of abuse or fraud. The protocol must be tested and monitored constantly. It must be reliable and robust to provide confidence and deterrance.

Given the user's dependency on someone else, I think KYC (Know Your Customer) policies are key to the solution, but knowing our users is not enough. The policies (hence accountabilities) must be extensible to those other users authorized to act on behalf of our users.

Feel free to share any thoughts/ideas/suggestions to set up such a solution.

In the blockchain and smart contracts ecosystem, the figure of the "intermediary" is quite common. Someone whose vote or final say allows (or denies) transactions between two or more entities/accounts. Our solution could adopt this shared authorization protocol. It would be a protocol based on consensus between two or more persons and our service.

As with any "democratic" process, transparency and traceability are important. The protocol must keep participants informed at all times (requester, benefactor, participants, dates and times, etc.)

If we solve the previous problem, left finding a way to provide users with a bit of "autonomy". A sustainable autonomy regarding credentials ownership.

For this case, I find biometrics a must-have because we all have (at least) one, and they don't need retention. Security based on biometrics is not more secure per se. It's still vulnerable, but hacking the biometrics of 2 or more participants who are fully aware and informed about the auth process is not that simple.

Biometrics can be our MFA. For example, they could replace temporal tokens with a text to be pronounced. The content doesn't even matter because we are not matching words. We look for matches in voices, cadences, tones, inflexions, accents, etc. We can train AI to enhance the validation so that the sentiments don't constrain the matching pattern. AI can be trained to detect fraud too.

The MFA could vary among participants, so we can adapt the mechanism to specific needs or incapacities.

Answer 5

It sounds like the main attack vector that's been abused is the three letter passwords, and it's easy to see how:

• Potentially multiple users have been authenticated on one shared computer, and you just need the three letter password to swap between them --- this is probably a more common setup than we'd like to imagine for e.g. schools, and it's not hard to see how it could be easily exploited.
• It sounds like we're talking people in e.g. a group / classroom situation, and it doesn't sound too far fetched to imagine that they might often leave their devices unattended while unlocked / type in their passwords rather slowly, such that the keystrokes are easy to observe. Again, it's easy to see how this could be abused by fellow classmates to gain access.

The guardian setup can't solve the problem

No matter what you do with the original guardian setup, it can't solve these problems, unless you make the guardian log in for them every time, which I would imagine to be an untenable hassle on their behalf.

Even if the initial guardian login used 2fa, retaining that login on the computer and abolishing the three letter passwords entirely (e.g. moving towards the type of solution that most popular websites use) doesn't work here, because you'll still need:

• The quick user switching (e.g. to support the shared computer case)
• Some sort of unlocking mechanism (e.g. to support the case where users leave their computers unattended --- it would be nice if we were able to provide a "lock" button for them / lock them after e.g. 5 minutes, and then they could reauth somehow when they come back).

App based authentication for the guardians also doesn't work

Giving an app to the guardians where they can remotely authorise requests doesn't help either --- while it would work in theory, in reality no-one's going to check that the person that sent the authorisation request is the person that's supposed to be able to use the computer, especially if it's around the same time where you might expect the real user to be requesting access.

I suppose you could do some sort of camera based solution (e.g. take a photo of the person making the request and display it), but that opens up a whole other host of problems, and plays back into the problem from the previous section: the last thing you want to be doing as a teacher in this scenario is pressing 20 accept buttons on your phone at the beginning of each class.

Authentication hardware

In my opinion, this is your only viable solution. You provide some authentication hardware, and the users authorise using this. For example:

• Fingerprint sensors, like TouchID
• Facial recognition sensors, like FaceID or Windows Hello
• USB hardware keys, like a YubiKey (hese can have fingerprint sensors built into them, and I'd really only recommend this variety in this context, as users are quite prone to just leaving the USB stick plugged into their computers the entire time, defeating the point in the physical access scenario described above)
• NFC Smart Cards
• etc

A lot of laptops come stock with at least one of these methods these days, and if not, it's relatively cheap to just get everyone some YubiKeys (or similar alternative). From your user's perspective, they just have to complete a very simple challenge (e.g. pressing a fingerprint sensor) and they're authenticated, and although you'll still need to do the initial login with the guardian (and configure the hardware authentication key in this step too), it's a lot more secure now, as WebAuthN is actually a robust security mechanism, rather than a simple three letter passcode.

You can do this entirely within the browser these days, with no third-party plugins, using the WebAuthN API. From a software perspective, the server generates a challenge, the user signs it using their private key (which is stored on / accessed via the hardware key), and then the server decodes it using their public key and ensures it matches up. You can read more about the spec, and see a demo of it in action in your browser, here: https://webauthn.guide/

Answer 6

I would tie the authentication to devices if possible. Require the guardian to enable a device for a specific user, and store some type of strong key in the cookie.

Ideally there should be one device per user, I believe most users would understand the concept of ownership, i.e. I should use my tablet/phone and you should use yours. You could also consider trying to push authentication down to the device level, where there is more support for various other authentication mechanisms. But this will likely not be possible to enforce if you are just a webpage.

I would assume the access to different features should be more or less aligned with what the user wants and is capable of doing, so I would expect there to be little harm if someone saw some video or music they where not intended to see.

People being mean to each other on the internet is unfortunately a problem that is as old as the internet is, without any clear solution. Monitoring messages is a good start. You might also consider taking photos of the user (assuming there is a webcam or front facing camera) when sending messages. That way you have a way to verify the actual user if the message was offensive.

But there is no way to automatically and reliably detect offensive messages, since it is in large part based on the intent of the sender. Some online games have completely removed chat, but players still abuse gestures, animations, or whatever is available to be offensive. But the only way to completely remove the risk of users being mean would be to remove all ways for users to communicate.

Answer 7

"Mental disabilities" is not a good distinguisher. Generally it is thought that about 20% of persons have some kind of mental disability. I'm pretty sure you are targeting one or more subsets of that; in that case you may need a more specific approach for each group you're targetting.

---

Biometric authentication may be of help. I guess that the disabled user should be able to present their face to accomplish about any task. Local PIN authentication could also be used (with a set number of retries). A quick search shows some positive results, e.g. in this paper

If you're using a web framework then there are authentication frameworks such as PassKey that may help you using the aforementioned biometric authentication options. It can e.g. use Windows Hello or Android biometrics to create a secure login.

Beware that biometrics & facial recognition may not be acceptable to all users, especially if the biometric device is in control of the institution rather than the user. Ethics as well as local law should be considered when going into this direction.

---

If you really think that strong authentication is required action then you should also require that the action is performed correctly. If you don't then there is no reason for authentication after all. In other words: if this action requires oversight then I guess it must be provided. In that case the entity performing the oversight might as well perform the authentication. If the guardian cannot remember a password then you might want to point them to a password manager (that's what I use for family that lack IT skills as well).

Alternatively you could authenticate the guardian, and then let them choose the test subject under their guardianship.

---

I'm not sure if there is any reason for MFA. MFA is used to create a more secure environment compared with entering a password. So it requires two factors.

I guess you could require a hardware tag that needs to be inserted in some kind of reading device in that case, so that something that you have is included in the MFA rather than something that you know. I'm sure that there are pretty big RFID tags to be found, that could be read by an antenna inside a receiver box.

Answer 8

Here's just an idea. Perhaps you can do without authentication.

If you need authentication only to map users to abilities, perhaps you can solve that problem without authentication.

For example, the initial screen is a "test" (e.g. a game) to gauge user abilities; gauge enough to be able to tailor web site characteristics or functions. Then perhaps you can add the posibility to "upgrade" to more features with more "tests".

Answer 9

Why change what works?

For rare or infrequent misuse, it sounds like you're over-engineering which reduces access and increases difficulty.

Audio might be a technique, to have someone read a small passage of text, or bluetooth (do they have smartwatches or phones?) however both are probably costly, unreliable, slow and complicated.

Best of all is probably to give them a menu of things that they already remember, like a secret question/answer, where the memorized detail actually is something they enjoy to remember or that they need to remember. Parent phone number, street number, name spelling, age, fun things, material tings, favorite things, tangible and intangible, all are options.

As so many people are very happy and comfortable sharing data, and it's essential to disclose & share if you want to overcome mistrust and suspicion, the only way to eliminate misuse is to shut down the system altogether, or over-complicate it, creating a need for frequent intervention, which often causes frequent outages anyway, due to the human & technical burdens!

Given most people are trying to alter and improve, you wouldn't want something that a person grows out of. Eg. Impairments that are overcome via diet or activity or medical assistance, different interactive partners, and the like, are probably best seen beyond static conditions or labels.

It could be said that you could integrate an access control system into a spaced repetition learning pattern.

Have you used systems which ask for a password, but if you get it wrong, asks for your previous remembered password? What if the password is their first initial, last initial, and age, and a street number, or the day of the week (1-7)? Is the impairment so profound any sequence has to be repetitive? Can images such as pictures be used to identify difference between 'person' 'age' 'address' etc, so those things can be exchanged or presented in a varying sequence?

Or have you used systems that remind you of only one random secret question at any time, but might ask you a different one if you get that wrong constantly? Or even, occasionally, ask you to review a pin number? This would be, one answer at a time, rather than eg. three on the same page, where you see the three questions, or three pictures.