Hacker News Reader

Comment by johnnyApplePRNG | Hacker News Reader

Probably a feature, not a bug.

Most mobile keyboards automatically capitalize the first character by default.

With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users.

This one small trick probably prevents millions of people from becoming frustrated with Google every single day.

And I'll bet it only works one way.

If your password was "ABCD", then by my logic "aBCD" should work.

But if your password was "abcd", then "Abcd" should not work.

View on HN

This is definitely a feature and not a bug. I was a little worried when we implemented this 5 years ago, but it turns out there's no real security risk here. My app was a financial app and so many people had trouble logging in on mobile that we basically had to implement this.

I would have thought password fields in particular would never auto-capitalize. Is this not the case?

Many people note their passwords down in eg. a text document. Not a great practice, but password management is a pain for most people. So when they do that, their editor might auto-capitalize the first character.

And then you see it's capitalized and change it.

No, even if you fix it... it will went wrong on the moment you click enter to save. Some mobile keyboards are just dumb enough to fight against users even they explicitly change it back. Some will have a option to disable it, but some probably won't.

No. What happens is people fail to login several times in a row and complain about it. This approach changes the security of a password basically not at all while reducing the number of people who become aggravated by not being able to login because they don't realize their capslock is on.

This depends on the implementation of the keyboard, which is not something you can rely on.

Some sites have a little switch that transforms the password field into a regular text one so you can see what you’re typing.

Most apps use the appropriate type of input field ("password") which the browser or mobile OS recognizes should not be capitalized. But some apps use a normal text input (with some masking/styling to make it look like a password field) which a mobile keyboard will normally capitalize. I get very annoyed when I see the latter.

As someone else mentioned, it's dependent on your choice of keyboard app on Android. The problem of having to trust another vendor is probably why my financial institution provides its own in-app keyboard for its apps.

That is a text field feature, not a keyboard feature. Google controls all the text fields for gmail. Both in the web version and in their native apps.

It is indeed [0], but there's about 14% of the browser world who can't benefit from it yet [1].

[0] https://developer.mozilla.org/en-US/docs/Web/HTML/Global_att...

[1] https://caniuse.com/mdn-api_htmlelement_autocapitalize

Realistically this is only going to affect people on mobile devices, which looks like it'd bring that down to about 6.5%

With over 1.5 billion active users... 6.5% is still a very large number of people!

Also.. not sure what safari/iOS did in their early years with keyboard password entry capitalization... but if they did auto capitalize... since Apple is so good at saving profile info across new installs/os updates... I imagine there would be a large portion of old apple users with perma-capitalized passwords out there as well.

iOS has never auto-capitalized type=“password”. It’s absolutely bonkers to me to imagine any mobile browser ever doing that, I was assuming some websites were reimplementing password fields badly with type=“text”.

It’s both a feature and a bug (well, a compromise with associated security risk). The feature is as you describe (and probably mitigates a lot of unnecessary account locks). The bug/compromise is that intentional or automated casing to achieve password complexity is a little bit less effective. I think the benefits of the feature outweigh the security risk, but it should also be widely disseminated, and anything dealing with passwords should take this into account.

if your pw was "abcd", then "Abcd" should work, right? Because it auto-capitalizes the first character of the first word. If your pw was "ABCD", then "abcd" (all-small) should be accepted because it auto-capitalizes and then you press the capital key once for caps, so it becomes all small.

Did I get anything wrong?

I can only speak to iOS here, but if you focus any field with auto-capitalization and immediately touch “shift” it just switches to lowercase, not caps lock. The only way to engage cruise control[1] is with (timing-configurable) double-tap.

1: https://pics.me.me/caps-lock-cruise-control-for-cool-image-5...

Some other sub-comment mentioned that Facebook used (I think they no longer that according to another comment) to account for first letter being capitalized, and for reverse case. For example a&Ope$G would be accepted in its original form, as well as A&Ope$G and A&oPE$g

Reply on news.ycombinator.com