Is it appropriate to display the warning message "Caps Lock is on" when focus shifts to Password field?
In gmail and yahoo I don't see it. So, what does the standard say?
Add a comment
|
5 Answers
What standard? Standard for Safari, Mac, Windows, Chrome, w3c, iso ...?
Some browsers do this automatically as 'standard'.
Some websites add the functionality so it's available in all browsers.
But it's not always possible (in all browsers on all platforms) to detect that caps lock is on whilst visiting a website although there is a workaround that requires the user to have already entered some text (based on the premise that if the user presses A, but shift was not down at the time, then caps lock must be on).
There's no standard that says you should do this, but I believe it's generally (ie not 100%!) accepted as a good thing to have, as its usefulness outweighs its existence.
answered Jul 11, 2011 at 7:33
-
Good answer, but I don't really understand "its usefulness outweighs its existence". What do you mean by that? Did you mean another word where you have existence? That would seem to make more sense to me. Commented Jul 11, 2011 at 17:39
-
2sorry - I was going to use the term 'cognitive load' but inadvertently ended up using something less meaningful and didn't really finish the sentence properly :-) My point there was that if and when you do happen to see this in action, then the chances are that it's going to be useful. You might deliberately have caps lock on when entering a password - but for those cases when you do (and therefore maybe see the warning as unnecessary), the occurrence of those situations is more than outweighed by the number of useful cases where you did not mean to have caps lock on. Commented Jul 11, 2011 at 17:49
-
That's what I thought you meant, and that's my thoughts on it exactly. Commented Jul 11, 2011 at 17:53
-
@Roger @Charles How about "its utility outweighs its cost (in cognitive load)"? :) Commented Jul 14, 2011 at 17:26
I haven't heard of a standard either, but I really like the way it is done in Mac OS X. It is very clear.
In Windows, there's a warning text message. While this might be easier to understand, it is more obtrusive.
answered Jul 11, 2011 at 11:48
-
13There's a reason it is more obtrusive. That little icon in Mac OS means absolutely nothing to me as a user. The warning message in Windows is much better because it stands out. Caps lock is something that many people don't notice because in general, they aren't observant of the little things. That icon is another example of a "little thing". Commented Jul 11, 2011 at 17:38
-
3+1, and the Windows message (if you mean the one at logon) only appears when the password is false, which is good imho because there are cases where the usage of caps lock is intended by the user (e.g. if his password only contains uppercase letters). Commented Jul 12, 2011 at 9:53
-
1But the Mac OS X (it didn't exist in Mac OS in the 90s) way is an idiomatic interface pattern. First time you see it you have to understand it, but most people do by trying, and then it will never bother you again, just help you. The Windows way is disturbing me every time. Commented Jul 12, 2011 at 13:23
-
2Most people don't leave CAPSLOCK on very often, so it really doesn't annoy them very much. Commented Jul 12, 2011 at 21:59
-
1@Matt - nope, the windows way appears as soon as you hit the password field with capslock on - I just checked Windows 7, Vista and Server 2008. And that is not a very good icon at all, because I had to zoom in quite a bit to be able to tell that was an arrow and not an exclamation mark. The fact that it is not clear is more evidence that it is not a good indicator. Commented Jul 13, 2011 at 18:05
You might want to do this, but only if the user has guessed his password wrong once already -- I believe this is how Windows normal login works, or worked at some point, at least. This way, you can protect users who use the caps lock key to type in their passwords (intentionally) from people with wandering eyes.
Instead of displaying a warning when Caps-Lock is on you could switch the letters if the first password fail first checking pASSWORD1234 and then Password1234 allowing the user to login as the user did input the right password, just mistakenly with a locked in modifier.
As Patrick McElhaney's edit to this answer clarified I'm not at all suggesting we should make our passwords case-insensitive. pASSWORD1234 would work, PASSword1234 and PassworD1234 would not.
The reason why this isn't really less secure is that for starters you would simply hash both pASSWORD1234 and Password1234 and check if they match your salted, crypto-strength hashed password in your database.
We are essentially giving the users 2 guesses per 1 input, but that doesn't mean this approach is vulnerable to brute forcing as the chance of guessing someones password after 100 attempts is minuscule to begin with. After you've had a large amount of bad guesses you would normally lock the user out either way.
-
2So, let's make passwords less secure as a way to get around capslock? Sorry, but no. Commented Jul 13, 2011 at 17:40
-
@Patrick, I think what Charles was saying was that in secure password management systems, the service provider doesn't actually know what the password is, only the hash of the password. (This is why well-designed services will let users who forget their password reset their password, rather than email it to them; you can't mail what you don't have.) Implementing your idea would mean going against a major security best practice.– AnirvanCommented Jul 13, 2011 at 21:43
-
@Anirvan That doesn't matter. The client would hash two versions of the password and try each of them. . Commented Jul 13, 2011 at 21:51
-
@Patrick, that makes sense, I guess. It's still a lot of work to do at any scale, and increases the chance you'd mess something up on the security side (because you couldn't rely on standard pre-built authentication frameworks anymore).– AnirvanCommented Jul 14, 2011 at 18:47
-
1@Anirvan - In anything I know I would just ask it to do login(password) and then login(invert(password)) to see which works. Alternatively wrap the default login which is about as much work. I'm not sure what it would be a lot of work to implement in. Commented Jul 15, 2011 at 3:09
It really depends on your users in my opinion. If you are seeing a lot of users have multiple views on he login page, or if it's possible in your system, the validation error message page more than what you would expect then there may be something holding them back from logging in. It could be the caps lock or it could be something else.
I would look at your stats, and then decide if you are going to implement something. If you do go with the caps lock approach, implement it and then review stats again for a month or so and see if the hits on the pages has reduced to be closer to the unique visits. If it has increased or unchanged (which with this change I would think it would decreases) then maybe the caps lock solution isn't helping and another change is required.
I guess all I am saying is that if you are going to do this incremental changes that may or may not be a web standard then benchmark your stats first and then review.
