Thread Subject: Re: Bios Password Accessibility

Note

This archival content is maintained by WebAIM and NCDAE on behalf of TEITAC and the U.S. Access Board . Additional details on the updates to section 508 and section 255 can be found at the Access Board web site.

From: Hoffman, Allen
Date: Thu, May 24 2007 7:00 AM

Thanks Peter, I was in a editorial meeting at the time and wasn't able
to hear your comments, let me think this through.



Allen Hoffman -- = EMAIL ADDRESS REMOVED = ; v: 202-447-0303

-----Original Message-----
From: = EMAIL ADDRESS REMOVED =
[mailto: = EMAIL ADDRESS REMOVED = ] On Behalf Of Peter Korn
Sent: Wednesday, May 23, 2007 8:04 PM
To: TEITAC General Interface Accessibility Subcommittee
Subject: Re: [teitac-general] Bios Password Accessibility

Hi Allen,

I want to re-iterate for the list some of my comments earlier today in
the face-to-face. I believe it is inappropriate for the 508 standard to
single out this particular type of firmware/hardware implementation.
The BIOS approach to booting systems - complete with their passwords for
authentication, encryption, etc. - is an implementation detail of many
x86-based systems. And just as we are diligently avoiding referencing
in the standard any particular operating system or user interface
technology, we should likewise not do so in this case.

Furthermore, the standard that is being contemplated involves specific
requirements around using sound and large print to make the x86-based
BIOS password/encryption technology somewhat accessible to some users
with some disabilities. We don't do that anywhere else in the standard
(single out some disabilities and say that if you cater to their needs
but not others' needs, you are able to meet the standard).

In the meeting I suggested that we might consider crafting
suggestions/advice - which would be separate from the standard -
advising agencies that they consider adding additional text to their
RFPs which specify x86-BIOS based systems with BIOS level passwords
and/or encryption: text further specifying that audio and large print be
used in any BIOS level password/encryption specified in the RFP since
doing so will at least help some users with some disabilities. But we
should recognize that such a system cannot comply with 508 as a whole -
doing so would be a fundamental alteration of the business use (the
presumptive requirement of BIOS level passwords/encryption on x86
systems). A vendor could claim fundamental alteration in this case -
but they should not make the assumption (and the agency making the
purchase should not make the assumption) that they have a fully 508
compliant product.

Since the meeting, I had another thought: the BIOS of an x86 system is
essentially a "closed product", and our usual closed rules apply. Such
a system should meet the functional requirements, and note which ones it
meets/fails in the VPAT. Thus a BIOS level password with audio beeps
and large print might meet the functional requirements for some who is
low vision or blind, but fail the functional requirements for someone
with a physical impairment. Supplemental advisory text to purchasers
and vendors might note that for the extremely simple user interface of
something like a single text-field prompt that is otherwise described in
the documentation, a beep to indicate its presence is sufficient.


But again, calling out the specific implementation of a specific pair of
functions on a specific class of hardware and crafting a standard for it
that only helps some users with some disabilities would be unique in our
desktop and software standards.


Regards,

Peter Korn
Accessibility Architect,
Sun Microsystems, Inc.


> Any improvement is an improvement.
> But, point taken.
>
> Another class here is pre-boot authentication software which is
> becoming more and more prevalent in government. Some requirements
> might be appropriate here.
>
>
>
> Allen Hoffman -- = EMAIL ADDRESS REMOVED = ; v: 202-447-0303
>
> -----Original Message-----
> From: = EMAIL ADDRESS REMOVED =
> [mailto: = EMAIL ADDRESS REMOVED = ] On Behalf Of Randy
> Marsden
> Sent: Wednesday, May 23, 2007 4:45 PM
> To: TEITAC General Interface Accessibility Subcommittee
> Subject: [teitac-general] Bios Password Accessibility
>
> Further to our discussion in today's meeting, I want to stress that
> there are people with physical disabilities who will not be able to
> enter a password without AT software running on the computer. Even
> though USB ports may be active at the BIOS level, and therefore AT
> that emulates keyboards at the hardware level can be used at that
> time, most AT used by people with physical impairments accomplish the
> keyboard emulation via software running on the computer in conjunction

> with their AT hardware (not in stand-alone mode). So, it would still
> leave the BIOS inaccessible to these people.
>
> I make the point so we make sure that if we solve the problem for
> people who are blind, that we haven't necessarily solved the problem
> for all people with disabilities.
>
> -Randy
>
>

WebAIM is an initiative of:
Center for Persons with Disabilities (CPD) Utah State University