zlacker

you have to account for someone using a on screen keyboard to input their credentials.

>>Xelbai+(OP)
Javascript code cannot see mouse movements outside of its page, like in an on screen keyboard or another webpage.

>>Xelbai+(OP)
They are a minority so its likely easy to account for, stuff like tracking them by learning their IP and transaction history to mark them with certain degree of trustability; on the other hand tracking mouse movements and other techniques are essential for users you have no record of (new ip, new user, new cc, etc)

>>Xelbai+(OP)
You mean on a touchscreen device, or because of a physical disability? Because the latter case seems exceptional enough that I'm not sure how that would legally work (do you have to think of all possible edge cases? What if someone uses dictation because they can't type, does that mean you'd potentially capture social security numbers if you use the microphone for gunshot detection and process the sound server-side?) and in the former case I'm pretty sure taps on a keyboard are not registered as a mouse movement in JavaScript.

>>lucb1e+v6
> or because of a physical disability? Because the latter case seems exceptional enough that I'm not sure how that would legally work

There have been a number of accessibility-based lawsuits recently. Generally speaking, yes, you absolutely have to allow for them to use an alternative system without locking them out.

Because if your particular methodology breaks things for a people group that way, all kinds of discrimination laws become a hammer that someone can toss your way.

>>shakna+qO
> allow for them to use an alternative system without locking them out

That's not what I'm arguing against, though. I was not saying: forbid screen readers. I said:

> do you have to think of all possible edge cases? What if someone uses dictation because they can't type, does that mean you'd potentially capture social security numbers if you use the microphone for gunshot detection and process the sound server-side?

>>lucb1e+K62
Inadvertently capturing social security numbers does actually open you up to a lot of PII laws. So yes, that is still a problem.

Any time you get data from a user, you need to be careful about what you're grabbing.