44

Many login screens automatically deactivate the Num Lock key on the keyboard before the user can enter their password. This is extremely frustrating for the user as they involuntarily type their password wrong multiple times before realising the Num Lock key is off.

Several undesirable side effects include:

  • Missing the password involuntarily 3 times, thereby locking the system,
  • Having a timeout after each missed password attempt, sometimes up to several minutes,
  • Frustration when one repeatedly forgets to activate the Num Lock key.

Moreover, I don't see what the reason for this would be from a security viewpoint. It does not enhance the quality of the password nor does it ward off any potential attacker.

So why are very widespread systems still using this extremely frustrating methodology?

Improve this question
18
  • 46
    Can you provide an example per your "many" claim? The most prevalent operating system's (Windows') login screen does not exhibit this failure, ahem "feature".
    – MonkeyZeus
    Apr 4, 2019 at 11:35
  • 60
    I never encountered a login screen that deactivates numlock. Are you perhaps mistaking the bios option to turn numlock on or off on boot as a "login screen feature"?
    – Gerald Schneider
    Apr 4, 2019 at 11:49
  • 6
    @leftaroundabout you seem to assume a password typed exclusively on the number pad, rather than just a few characters; you also seem to assume that a user only uses one type of keyboard to log in to a system. (I have, once, used a system with an ultracompact builtin keyboard with no number row and a USB number pad, as an example of an edge case where this would be particularly irritating)
    – Chris H
    Apr 4, 2019 at 15:19
  • 15
    At this point I'd be happy with ONE example of a login screen that does this. I've never seen it.
    – JPhi1618
    Apr 5, 2019 at 4:32
  • 8
    @Klangen there are more up votes on the multiple comments asking you to substantiate this actually happens than there are on your question, so I'm not sure "well-received" is exactly accurate. We do have one example in the comments from Tom where it's definitely tied to the login screen rather than rebooting, but IMO your question would be improved if you edited in where you've seen this in more detail. It's definitely not standard functionality on Windows, so knowing more could help us answer what the purpose is.
    – Kat
    Apr 5, 2019 at 16:52

3 Answers 3

Reset to default
71

Some compact keyboard layouts don't have a numpad, so those keys are mapped to the right-hand side of the letter section: enter image description here

If NumLock is on, then a user typing the password kill, will actually type 2533. Turning NumLock off will prevent this problem, but of course - it will cause another one for those who do rely on the numpad. Keeping it on or off by default will lead to mode errors - regardless of what initial state is chosen, someone will be surprised by it.

A better solution would be to reflect the state of the NumLock key on the screen, akin to the CapsLock key. This way there are no surprises, as this state indicator is in the users' locus of attention.

An example are Acer Revo computers, distributed with compact wireless keyboards. I installed a fresh OS and set up a password, then successfully "confirmed" it. However, what I thought I was doing was different from what the computer saw me do. This problem only became evident when I attempted to connect to the machine remotely, from a place with a proper keyboard.

Many hours and "this cannot be" statements later, I undersood that NumLock was the culprit.

Improve this answer
7
  • 10
    How come the cause of mode errors is keeping NumLock on or off by default, rather than changing NumLock's state without the user's knowledge or will? I'd have thought that keeping it on or off by default will lead to the keyboard behaving as the user expects.
    – Rosie F
    Apr 4, 2019 at 18:55
  • 3
    I've got one of those keyboards for when I need to log in locally to a normally-headless server, and I can't tell you how many times I've tried to log in as "r66t".
    – Mark
    Apr 4, 2019 at 21:01
  • 2
    Rosie, you raise a valid point. The reason I wrote that is because of the expectation that pressing o yields an "o". When NumLock is on, that yields a "6" (hidden under *, ha!). If one uses a numpad to type 1966, it yields 19→→ if NumLock is off. So, users from both camps can be caught off-guard, regardless of the default value. So it is not that the system sneakily changed the state; nowadays people use diverse keyboards in different places, a system can't guess what this user is used to. Numlock=off is the lowest common denominator, as more and more keyboards don't have numpads.
    – ralien
    Apr 4, 2019 at 22:51
  • 2
    Fn-Keys are usually not mapped using NumLock. I guess one of the reasons is this issue. On quite a few devices using Fn-Keys, I never saw one using NumLock for switching. Usually you need to always press Fn, sometimes there is an option to reverse the behaviour (e.g. on notebooks, where multimedia keys are the default an Fx keys need Fn you can often switch this in the BIOS).
    – allo
    Apr 5, 2019 at 10:15
  • I agree with Rosie, changing a user’s default behavior is not good UX and most of all will lead to fewer errors. I also agree with the answer, if this is a necessary consideration to display the state on screen. I’d argue it isn’t necessary as billions of people have been fine for decades.
    – vol7ron
    Apr 5, 2019 at 23:44
9

It's a bad UX practice primarily because the user is not expecting this to happen. Users will attempt to do an action and will not be able to do so.

Improve this answer
4

Many login screens automatically deactivate the Num Lock key on the keyboard before the user can enter their password.

I don't believe that this is true.

It may be that Num Lock happens to be off when at a login screen, but I doubt that the login screen is actively turning it off. That is, it's not intentionally done as some way to enhance security (because it doesn't); it's an artifact of how the rest of the system is designed.

On Windows, whether Num Lock is on or off is a user-specific preference. If you have a multi-user system and one person prefers Num Lock on and another user prefers Num Lock off, what should the behavior be at the login screen when no one is logged in?

If I log out, my preferences should no longer be active. Instead, the "default" user's preferences become active, and those are likely to have Num Lock off because that's the safer default for compact/laptop keyboards. (On Windows, this would be stored in the registry, encoded in HKEY_USERS\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators.)

Improve this answer
1
  • As far as I understand, this regedit attribute is only read after startup, and doesn't have any influence on the login screen. NumLock status also seems to be independent from BIOS settings, at least on my Win10.
    – Eric Duminil
    Apr 12, 2019 at 13:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.