Item — HN Reader

> Why then, do all the major OSs warn you when you've turned caps lock on while you're trying to login?

It's not clear to me that this is a security issue or that it reveals any information to an attacker? Presumably the keyboard also provides notification that caps lock is no, so the login system is not providing any additional information not already available to an attacker.

1 comments

This is partially true. However, a fair few keyboards (and laptop keyboards) aren't making it THAT clear that caps lock is on anymore. Given that most people would rather use shift to make an uppercase in a password (at least the ones I know), leaving caps lock on when you're away from your computer is a quick and dirty deterrent from someone who may have watched you enter passwords earlier...

If someone is memorising your password from watching you type it in, caps lock being in an unexpected state is not going to hold them up for long.

I agree with mooism2. Also, viewing security as a cost-benefit tradeoff, it seems the usability penalty for not alerting people that caps lock is on is much larger than any security benefit.