Keywords

1 Introduction

The ability to create, retain and enter passwords requires a number of cognitive skills. These include literacy, the ability to focus, creativity, problem-solving, decision making, attentional abilities, and the ability to keep secrets [34]. When someone enters a password, they subsequently have to be able to remember it, including the exact spelling, or order, of the password symbols. Having done so, they have to type the password, mentally tracking the position of the character typed, and advancing to the next character as they type. For many, this is straightforward. However, consider how one specific disability, dyslexia, affects this process. Dyslexia has been defined [20] as: “…a specific learning disability that is neurobiological in origin. It is characterized by difficulties with accurate and/or fluent word recognition and by poor spelling and decoding abilities… Secondary consequences may include problems in reading comprehension and reduced reading experience that can impede growth of vocabulary and background knowledge.”

Powell et al. [33] consider dyslexia as something of a mismatch between overall cognitive and language ability. They state that this mismatch and extent of disability varies from person to person. Dyslexics generally have poor handwriting, spelling and reading. They sometimes have poor short-term memory abilities and can organise themselves inadequately. On the other hand, many are particularly strong at visualisation, spatial awareness, creativity, and lateral thinking [52].

The research literature into dyslexia, which spans many years, is extensive and occasionally contradictory, with continued debates, especially in the domains of definition and diagnosis. As Kirby [23] points out: “it is useful to think of dyslexia as a both an ongoing psychological diagnosis and a social construct, with all that entails” (p.59).

Whatever its nature, the difficulties experienced by dyslexics are clear. One particular difficulty lies in processing sequenced symbolic information [33]. Morris et al. [30] explored the impact of dyslexia on web searching, given the need to be able to spell and read efficaciously, and recommend enhancing readability into search interfaces to help dyslexics. Powell et al. [33] suggest a number of guidelines for the design of websites to accommodate those with dyslexia; however, these are not necessarily applicable to authentication design where passwords are the dependency. De Santana et al. [11] also derived a number of guidelines to inform the design of accessible websites for dyslexics.

However, creating, remembering and entering passwords also requires skills that many dyslexics tend to struggle with [37]. Helkala [19] explores the dimensions of these difficulties. Spelling is particularly challenging for dyslexics [15]. Spelling of words is unstable, with many dyslexics spelling the same word differently on different days, with frequent confusion of letter ordering within words. Figure 1 demonstrates the difficulties dyslexics experience in reading, via the example of relatively simple words. Figure 2 demonstrates how a password such as “Belladonna!” could be altered due to dyslexia.

Fig. 1.
figure 1

This image demonstrates how dyslexics might see words [25] (p.5).

Full size image
Fig. 2.
figure 2

This image demonstrates how dyslexics might enter a password

Full size image

Some estimates suggest that up to 20% of English speakers suffer from dyslexia [30]. Given the fact that, at least in the European Union, websites are required to ensure accessibility, and as the W3C advises [49], we cannot ignore the fact that passwords and dyslexia might well be a problematical combination. There is evidence that some dyslexics make use of spelling checkers to alleviate or correct the errors they might make in other web uses [2]. On the other hand, spell-checkers are an inappropriate tool to alleviate password-related issues, nor are electronic readers useful in this respect [37].

Other opportunities to explore authentication options, for example in the recent design of ATM (Automated Teller Machine) interface to accommodate dyslexics [44], have not focused upon this aspect of PIN authentication. Alternatives such as biometrics [8, 38] or alternative visual approaches (e.g. [9, 10]) have also been proposed. Shih et al. [43] have attempted to address the core elements of the interaction design in terms of fonts, ordering, colours and contrast, and so forth, as do, for instance, UX Movement [47]. We wanted to find guidelines that applied specifically to authentication design, and to the most widely used authentication mechanism, the password. As a relative of the password, the verification and confirmation codes, and on-time passwords, which continue to proliferate, will require attention we assume. The next section outlines how we went about doing this.

2 Literature Review

We searched the literature to exhaustively to find out what the research had to teach us about how dyslexics cope with passwords, the challenges they experience, and the solutions proposed to help them. We used the search term: (“dyslexia” or “dyslexic”) and “passwords”. Papers were included if they reported on dyslexics using passwords. In terms of criteria, if dyslexia was only mentioned in passing, or the paper was not considering passwords, then this was excluded from our comprehensive search results. As recommended by Lowry [27], we searched Academic Search Premier, SCOPUS, Social Science Citation Index, Science Citation Index, ACM Digital Library, IEEE Xplore, Springer, JSTOR, ProQuest, PsychInfo and ERIC.

Our simplified and truncated review meant that peer reviewed papers and chapters were included, as were postgraduate theses and related papers, although all patents were deliberately excluded. We attempted a thorough search, and adapted our criteria for inclusion as we encountered several challenges finding relevant literature in this specific area of conjunction. In many respects, we have noted a HCI (Human-Computer Interaction) bias within many of the resulting finds. Figure 3 depicts the range of research that we identified as touching on dyslexia that emerged from our literature search. It highlights the sparse attention paid to passwords across all these papers and visualises the relationship between many of the key areas.

Fig. 3.
figure 3

Range of dyslexia related research (Password Topics Highlighted)

Full size image

Our main results are illustrated in Table 1, wherein the more salient papers are grouped together within their associated topic and category. This categorisation was developed bottom-up, taking a pragmatic approach, to the drawing out these five main themes in order to develop our understanding of previous research as reflected by the literature within the domain.

Table 1. Main categories of dyslexia-related research.
Full size table

Only three prior studies relate to our topic of interest. The work of Subashini and Sumitra [45], addressing disabilities and passwords, examined the use of One-Time Passwords (OTPs) and multimodal approaches in the context of banking-like authentication. Dyslexic users were studied alongside people with visual disabilities, as they advocated for approaches encompassing more than one modality. Similarly, Helkala [19] looked at some of the inherent issues in recall, delay and misspelling. The password alternative explored by Gibson et al. [16] used musical clips instead of alphanumeric strings. People chose “their” secret clip from successive challenge sets, in order to authenticate. The paper alludes to the benefits of such a scheme in improving authentication accessibility for dyslexics.

3 Reflections on the Literature and Emerging Trends

The literature demonstrates a growing use and application of augmented environments and approaches, perhaps as a function of advancement of technology. In line with the development of assistive technologies, designed to support those with a myriad of challenges, we predict increasing deployment of mixed reality technologies in this respect.

For many services offered online, or at least accessed after online authentication, there is a growth of hybrid and multi-step approaches. Whilst improving overall security, these are likely to negatively affect those with dyslexia. The expectation of further handling and use of passwords and extra steps being required is inherent in this approach. The OTP (one-time password) approach is similar in many regards, often requiring entry of a meaningless alphanumeric string. The way in which those with dyslexia encounter these scenarios, where ability to replicate a string perfectly is required is, thus far, relatively neglected. The research by Fuglerud and Dale [13] being a notable exception, their work tackling identity management and passwords for the elderly and those with disability.

As we are often reminded, password strength is generally encouraged, in order to improve access, and thus system security (e.g. [32]). However, it is likely that, from the viewpoint of a dyslexic user, this will worsen matters, making the task of remembering and entering the password correctly even more challenging. There are open research questions related to how dyslexics currently cope with increasing password strength requirements. Which strategies are adopted and how do these impact security and usability?

The competing constructs and requirements of security and usability have been noted as a balancing act of sorts (e.g. [18]). Our investigation highlights a third construct that cannot be ignored: that of accessibility. The Web Accessibility Initiative explains that accessibility “addresses discriminatory aspects related to equivalent user experience for people with disabilities” [50].

We have had over two decades to try to resolve the tension between security and usability identified by Adams and Sasse [1]. The addition of accessibility as an extra dimension undeniably adds complexity to the design process. The tensions between these three needs potentially compete with one another in the designer’s mind.

Accessibility needs cannot be ignored. The UK’s Disability Discrimination ActFootnote 1 of 1995 requires websites to ensure equality in access to people with all kinds of disabilities. The European Union also has an accessibility actFootnote 2 which requires those delivering products and services to accommodate the disabled. Finally, the United Nations Convention on the Rights of Persons with DisabilitiesFootnote 3, adopted on the 13 December 2006, is the first international, legally binding instrument that sets minimum standards for the rights of people with disabilities. Accessibility is clearly a legal mandate and there is no reason to believe that password authentication is excluded.

A number of researchers have highlighted existing accessibility issues that impact people with different kinds of disabilities e.g. blindness [44], age-related infirmities [47] and general accessibility failures of e-government websites [24]. It is clear that authentication design also needs to ensure accessibility to accommodate the needs of dyslexics and people with other disabilities, in addition to paying attention to security and usability design considerations.

Limitation of our investigation into dyslexia and password usage, reported here, include our focus solely on English language literature, excluding all literature in other languages. In addition, we adopted a narrow, security-focus, in our review and examination of this condition, as opposed to a addressing much broader social and psychological perspective.

4 Discussion and Recommendations for Future Research

In summary, from our practical review of the literature, and the discovery of this largely neglected topic of dyslexia in the context of password usage, we propose several recommendations for future research. These are:

  1. 1)

    Real-world coping strategies and behaviours – given the dearth of studies in the area of dyslexia and password usage, research is needed to study how dyslexic users of systems approach password creation, retention and everyday use. It is likely that coping strategies are, to a certain extent, common across this group, and may lead to suggestions as to how we may design more accessible and dyslexic-friendly authentication approaches.

  2. 2)

    Password managers and their adoption – in what ways can we refine and adapt approaches to strong and yet centralised passwords to enable a more convenient usage experience for those experiencing dyslexia challenges. How can this be implemented effectively across multiple devices and platforms, e.g. mobile devices.

  3. 3)

    Multi-factor authentication – where some tokens are to be remembered, or indeed, where OTPs have to be entered, are clearly going to negatively impact dyslexics. How can these mechanisms be made more accommodating of, or designed for, the needs of dyslexic users? A growing number of services demand multi-stage authentication, and this may prove increasingly problematic.

  4. 4)

    Alternative authentication mechanisms – as we look to more inclusive perspectives to authentication, and as more essential services mandate passwords, can we consider a greater diversity of technologies, processes and opportunities to meet the needs of those for whom alphanumeric passwords are challenging [10, 16]. What additional accessibility issues may such alternatives introduce?

  5. 5)

    Understanding dyslexia in the security context – there is a growing body of literature in the area of pupils, students and learning (for those with dyslexia and similar challenges). The demands of particular technology-mediated tasks warrants serious consideration in order to ensure that we design security for all.

  6. 6)

    Carrying out studies with dyslexics – for ethical purposes it is important for truly informed consent to be obtained. For dyslexics, this means ensuring that the consent form is clear, unambiguous and uses simple language. Online survey pre-screening could assist in providing access to participants, but is dependent on them self-identifying as such. Moreover, it might be best to conduct verbal interviews rather than asking dyslexics to complete online surveys.

In summary, dedicated research in this area should seek to answer at least the following research questions:

  1. 1)

    In which contexts do dyslexics struggle with passwords, and to what extent?

  2. 2)

    What strategies do dyslexics employ, if any, to cope with the demands of passwords?

  3. 3)

    How could we help dyslexics to cope with the passwords and equivalent authentication steps, in their lives?

  4. 4)

    How should organizations go about making their websites and services more accessible to dyslexics if they use passwords as an authentication mechanism?

5 Conclusion

In this paper, we highlight the fact that dyslexics are likely to struggle with passwords and make the argument for accessibility, and this specific area, to join security and usability as essential dimensions of the authentication design process. Until some other authentication mechanism supplants the password in everyday life, accessibility of authentication needs to be given the prominence it deserves. It is proposed that people-based rigorous research is required to gain a deeper understanding of dyslexia and its impact. We suggest some directions for essential research in this area.