Is it appropriate to display the warning message "Caps Lock is on" when focus shifts to Password field?
In gmail and yahoo I don't see it. So, what does the standard say?
What standard? Standard for Safari, Mac, Windows, Chrome, w3c, iso ...?
Some browsers do this automatically as 'standard'.
Some websites add the functionality so it's available in all browsers.
But it's not always possible (in all browsers on all platforms) to detect that caps lock is on whilst visiting a website although there is a workaround that requires the user to have already entered some text (based on the premise that if the user presses A, but shift was not down at the time, then caps lock must be on).
There's no standard that says you should do this, but I believe it's generally (ie not 100%!) accepted as a good thing to have, as its usefulness outweighs its existence.
You might want to do this, but only if the user has guessed his password wrong once already -- I believe this is how Windows normal login works, or worked at some point, at least. This way, you can protect users who use the caps lock key to type in their passwords (intentionally) from people with wandering eyes.
Instead of displaying a warning when Caps-Lock is on you could switch the letters if the first password fail first checking
pASSWORD1234 and then
Password1234 allowing the user to login as the user did input the right password, just mistakenly with a locked in modifier.
As Patrick McElhaney's edit to this answer clarified I'm not at all suggesting we should make our passwords case-insensitive.
pASSWORD1234 would work,
PassworD1234 would not.
The reason why this isn't really less secure is that for starters you would simply hash both
Password1234 and check if they match your salted, crypto-strength hashed password in your database.
We are essentially giving the users 2 guesses per 1 input, but that doesn't mean this approach is vulnerable to brute forcing as the chance of guessing someones password after 100 attempts is minuscule to begin with. After you've had a large amount of bad guesses you would normally lock the user out either way.
It really depends on your users in my opinion. If you are seeing a lot of users have multiple views on he login page, or if it's possible in your system, the validation error message page more than what you would expect then there may be something holding them back from logging in. It could be the caps lock or it could be something else.
I would look at your stats, and then decide if you are going to implement something. If you do go with the caps lock approach, implement it and then review stats again for a month or so and see if the hits on the pages has reduced to be closer to the unique visits. If it has increased or unchanged (which with this change I would think it would decreases) then maybe the caps lock solution isn't helping and another change is required.
I guess all I am saying is that if you are going to do this incremental changes that may or may not be a web standard then benchmark your stats first and then review.