8

Many login screens warn the user if the caps lock key is switched on. Most prominently the windows login screen.

Does this offer any advantage compared to simply ignoring the caps lock key and detecting the key-presses for the password as if caps lock were disabled?

Why is the warning apparently best practice? Are there uses cases that require caps lock to work inside password fields? Is there a significant fraction of users that choose to enter a password with enabled caps lock?


The reason for the warning is apparent: Since the password characters are hidden, the user may not notice when caps lock is accidentally switched on, causing their login to fail.
There are ways to work around this, such as not hiding the password, or accepting multiple uppercase/lowercase variants of the password. These work even in situations such as web forms, where detecting caps lock state may be difficult.

But assuming that

  • hidden characters and case-sensitive passwords are desired, and
  • the target application is capable of detecting caps lock state

Why should I display a warning instead of silently solving the issue by disabling the caps lock functionality in password fields?

5
  • 2
    Because the average computer user does not work with computers the way we do. They will continuously type in their "correct" password and at one point assume they are hacked; without checking caps-lock. Login screens warn the user in advance, to prevent said rage. Jan 17, 2016 at 1:13
  • 2
    You'll be surprised how many people hit CapsLock>Key>Capslock instead of doing Shift+Key. It never ceases to amaze me, but there it is. Jan 17, 2016 at 12:28
  • 1
    I think Facebook's approach is the best...
    – wb9688
    Jan 17, 2016 at 20:57
  • 5
    I need to use capslock when i want to type capizalized letters while only having one hand free. You want that my password fails, don't you?
    – BlueWizard
    Jan 18, 2016 at 6:34
  • The browser can know about the Caps Lock key, but (I strongly suspect) the application doesn't (or, at a minimum, not all do). The browser could disable the effect of the Caps Lock key when it believes the application is asking for a password, but -- thanks to the myriad ways of asking -- it won't always know when a password is being entered, and won't always enable/disable it consistently.
    – TripeHound
    Oct 24, 2017 at 15:25

5 Answers 5

11

The core reason that you don't want to do this is because, as a general rule, any time you override the standard behavior of a users device, you open yourself up to a bad user experience . . . particularly if you do it without any kind of notification.

Overall, within your application, standard control behaviors should continue to behave the way that the user expects them to behave.


Now, in this case, the change would not likely be known, since the password generally stays masked, but, both technically and experientially, there are ways that it could become apparent.

Example 1: many new technologies are allowing you the "show password" when entering it. This would quickly expose the altered behavior (sans any explanation). Best case, this causes confusion, worst case, they conclude that their keyboard is broken.

Example 2: if a users password were "abc123XYZ", there may be times when the user were to use caps lock for the last 3 characters (e.g., on a mobile device) and others when they want to hold down the shift key (e.g., when using a full keyboard).

If the caps lock were suppressed when the password was created, there is potential that the password was actually set to "abc123xyz", without the user ever knowing it, because they expected the key to function normally. Best case, this causes confusion, worst case, their account gets locked due to too many "bad login attempts", despite having entered in what should have been the correct characters.

1

It's a good practice because any good UI should tell you of its current state; It's not so much of a warning, more of a notification.

Accepting multiple variants of the password is really bad; you're essentially reducing the complexity of the password.

By disabling caps lock you're taking control away from the user and the only reason seems to be just to not show that warning/notification.

1
  • I don't think they mean getting rid of capital letters, just capslock. Shift would still work. It just prevents you from entering PassWord1234 as pASSwORD1234. Jan 17, 2016 at 14:50
1

EDIT: oops, I misunderstood the question.

You don't want to 'disable' Caps Lock because how exactly would you communicate to users that this mode is unachievable? Some users may not know how to use Shift to temporarily enforce uppercase, and may not be able to type their password anymore.

Besides, it seems unintuitive that a functionality of your keyboard becomes unavailable when using an input field on a website on a specific application. How would you go about programmatically disabling Caps Lock on the user's system, so that the keyboard's mode feedback is properly aligned? It would pose serious security issues if websites were able to do such things with JS code.


Old answer (offtopic)

Uppercase letters are distinct from lowercase ones in passwords because of a thing called password entropy, aka. the number of significant bits of information in a password. Having a larger alphabet of symbols to draw from increases the entropy of the passwords*.

By removing uppercase symbols, you would thus lower the security of your passwords. Because the caps lock switch is a mode that is maintained on its own without continuous user action, it is necessary to display feedback in situations where the user must be aware the mode is enabled in order to fulfil their task successfully.


(* this is an overly simplistic view, many people in security research miscalculate password entropies by not taking into account the relative probabilities of some symbols appearing at some positions of some passwords. Still, the general concept is that more characters to choose from lead to a potentially higher overall entropy of passwords)

0

The answer to this is that windows should accept the password if you enter it in the correct case, or, exactly the incorrect case (if CAPS is on).

e.g. abc123XYZ or ABC123xyz (if CAPS was on) would be accepted.

As a CAD user I often have caps lock on, and find it so annoying having to type the password twice because the machine hasn't been smart enough to realise - that caps lock is on - that I've typed my password correctly had caps lock been off

It's not rocket science.

1
  • You are making the assumption that Caps Lock only changes the letter keys, and results in the same letter with opposite case. That is far from universal. See the AZERTY keyboard where depending on user settings, Caps Lock may or may not lock digits. Also some settings will make shift release Caps Lock. So you can just guess that the input is either correct or fully reversed.
    – jcaron
    Aug 31, 2018 at 12:29
-1

SIMPLE SOLUTION: The Operating System simply need to recognize the CAP LOCK ON the whole time or OFF the whole time. Example: Correct password is abc123XYZ therefore ABC123xyz will be accepted (but abc123xyz will NOT be accepted).

1
  • 2
    This assumes common modifier functionality across devices. On OSX, for instance, caps lock forces all caps, regardless of whether shift is used. so the difference would be abc123XYZ vs ABC123XYZ. Oct 26, 2017 at 0:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.