Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

What happens when security measures cannot be used by everyone? Any security control that is not accessible becomes a barrier, and barriers trigger unsafe workarounds that create security risks.

We face a paradox, security mechanisms designed to protect users can systematically exclude the most vulnerable populations, including people with disabilities and older adults, and this exclusion can become an exploitable vulnerability. Users facing accessibility barriers adopt insecure coping mechanisms: sharing passwords, delegating authentication to others, storing credentials insecurely, relying on weaker fallback paths, or abandoning security measures altogether. Each workaround is a predictable security failure caused not by user negligence, but by design choices that made the secure path inaccessible.

This presentation introduces Secure-by-Inclusion, a new practical approach that ensures that security controls actually function for all intended users across diverse abilities, devices, and assistive technologies.

We will walk through common patterns where security and accessibility collide, including CAPTCHAs, multi-factor authentication, biometric authentication, time-limited one-time codes, brittle account recovery flows, and inaccessible verification steps. For each pattern, we connect the accessibility failure to concrete security outcomes, then show safer, more inclusive alternatives. We will also look into the European Accessibility Act (EAA) and the WCAG 2.2 Accessible Authentication requirements, examining their implications for security design and testing.

We will learn practical techniques for incorporating inclusive evaluation into security testing practices and identify accessibility gaps as security vulnerabilities. Accessibility and security might seem like separate disciplines, but they share common goals: protecting users and ensuring inclusive, trustworthy digital experiences.