7 ms·

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my logic "aBCD" should work. But if your password was "abcd", then "Abcd" should not work.

deleted 5y ago
[deleted]
st3fan 5y ago
That is a text field feature, not a keyboard feature. Google controls all the text fields for gmail. Both in the web version and in their native apps.
- johnnyApplePRNG 5y ago
  It is indeed [0], but there's about 14% of the browser world who can't benefit from it yet [1]. [0] https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/autocapitalize https://developer.mozilla.org/en-US/docs/Web/HTML/Global_att... [1] https://caniuse.com/mdn-api_htmlelement_autocapitalize https://caniuse.com/mdn-api_htmlelement_autocapitalize
  - philo23 5y ago
    Realistically this is only going to affect people on mobile devices, which looks like it'd bring that down to about 6.5%
    - johnnyApplePRNG 5y ago
      With over 1.5 billion active users... 6.5% is still a very large number of people! Also.. not sure what safari/iOS did in their early years with keyboard password entry capitalization... but if they did auto capitalize... since Apple is so good at saving profile info across new installs/os updates... I imagine there would be a large portion of old apple users with perma-capitalized passwords out there as well.
      - eyelidlessness 5y ago
        iOS has never auto-capitalized type=“password”. It’s absolutely bonkers to me to imagine any mobile browser ever doing that, I was assuming some websites were reimplementing password fields badly with type=“text”.
chrisshroba 5y ago
I would have thought password fields in particular would never auto-capitalize. Is this not the case?
- afavour 5y ago
  Some sites have a little switch that transforms the password field into a regular text one so you can see what you’re typing.
- sz4kerto 5y ago
  Many people note their passwords down in eg. a text document. Not a great practice, but password management is a pain for most people. So when they do that, their editor might auto-capitalize the first character.
  - croes 5y ago
    And then you see it's capitalized and change it.
    - UncleMeat 5y ago
      No. What happens is people fail to login several times in a row and complain about it. This approach changes the security of a password basically not at all while reducing the number of people who become aggravated by not being able to login because they don't realize their capslock is on.
    - mmis1000 5y ago
      No, even if you fix it... it will went wrong on the moment you click enter to save. Some mobile keyboards are just dumb enough to fight against users even they explicitly change it back. Some will have a option to disable it, but some probably won't.
- pindab0ter 5y ago
  This depends on the implementation of the keyboard, which is not something you can rely on.
hallway_monitor 5y ago
This is definitely a feature and not a bug. I was a little worried when we implemented this 5 years ago, but it turns out there's no real security risk here. My app was a financial app and so many people had trouble logging in on mobile that we basically had to implement this.
- deleted 5y ago
  [deleted]
AlexanderTheGr8 5y ago
if your pw was "abcd", then "Abcd" should work, right? Because it auto-capitalizes the first character of the first word. If your pw was "ABCD", then "abcd" (all-small) should be accepted because it auto-capitalizes and then you press the capital key once for caps, so it becomes all small. Did I get anything wrong?
- Bilal_io 5y ago
  Some other sub-comment mentioned that Facebook used (I think they no longer that according to another comment) to account for first letter being capitalized, and for reverse case. For example a&Ope$G would be accepted in its original form, as well as A&Ope$G and A&oPE$g
- eyelidlessness 5y ago
  I can only speak to iOS here, but if you focus any field with auto-capitalization and immediately touch “shift” it just switches to lowercase, not caps lock. The only way to engage cruise control[1] is with (timing-configurable) double-tap. 1: https://pics.me.me/caps-lock-cruise-control-for-cool-image-541329-53762267.png https://pics.me.me/caps-lock-cruise-control-for-cool-image-5...
eyelidlessness 5y ago
It’s both a feature and a bug (well, a compromise with associated security risk). The feature is as you describe (and probably mitigates a lot of unnecessary account locks). The bug/compromise is that intentional or automated casing to achieve password complexity is a little bit less effective. I think the benefits of the feature outweigh the security risk, but it should also be widely disseminated, and anything dealing with passwords should take this into account.

deleted 5y ago

[deleted]

st3fan 5y ago

That is a text field feature, not a keyboard feature. Google controls all the text fields for gmail. Both in the web version and in their native apps.

johnnyApplePRNG 5y ago
It is indeed [0], but there's about 14% of the browser world who can't benefit from it yet [1]. [0] https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/autocapitalize https://developer.mozilla.org/en-US/docs/Web/HTML/Global_att... [1] https://caniuse.com/mdn-api_htmlelement_autocapitalize https://caniuse.com/mdn-api_htmlelement_autocapitalize
- philo23 5y ago
  Realistically this is only going to affect people on mobile devices, which looks like it'd bring that down to about 6.5%
  - johnnyApplePRNG 5y ago
    With over 1.5 billion active users... 6.5% is still a very large number of people! Also.. not sure what safari/iOS did in their early years with keyboard password entry capitalization... but if they did auto capitalize... since Apple is so good at saving profile info across new installs/os updates... I imagine there would be a large portion of old apple users with perma-capitalized passwords out there as well.
    - eyelidlessness 5y ago
      iOS has never auto-capitalized type=“password”. It’s absolutely bonkers to me to imagine any mobile browser ever doing that, I was assuming some websites were reimplementing password fields badly with type=“text”.

chrisshroba 5y ago

I would have thought password fields in particular would never auto-capitalize. Is this not the case?

afavour 5y ago
Some sites have a little switch that transforms the password field into a regular text one so you can see what you’re typing.
sz4kerto 5y ago
Many people note their passwords down in eg. a text document. Not a great practice, but password management is a pain for most people. So when they do that, their editor might auto-capitalize the first character.
- croes 5y ago
  And then you see it's capitalized and change it.
  - UncleMeat 5y ago
    No. What happens is people fail to login several times in a row and complain about it. This approach changes the security of a password basically not at all while reducing the number of people who become aggravated by not being able to login because they don't realize their capslock is on.
  - mmis1000 5y ago
    No, even if you fix it... it will went wrong on the moment you click enter to save. Some mobile keyboards are just dumb enough to fight against users even they explicitly change it back. Some will have a option to disable it, but some probably won't.
pindab0ter 5y ago
This depends on the implementation of the keyboard, which is not something you can rely on.

hallway_monitor 5y ago

This is definitely a feature and not a bug. I was a little worried when we implemented this 5 years ago, but it turns out there's no real security risk here. My app was a financial app and so many people had trouble logging in on mobile that we basically had to implement this.

deleted 5y ago
[deleted]

AlexanderTheGr8 5y ago

if your pw was "abcd", then "Abcd" should work, right? Because it auto-capitalizes the first character of the first word. If your pw was "ABCD", then "abcd" (all-small) should be accepted because it auto-capitalizes and then you press the capital key once for caps, so it becomes all small. Did I get anything wrong?

Bilal_io 5y ago
Some other sub-comment mentioned that Facebook used (I think they no longer that according to another comment) to account for first letter being capitalized, and for reverse case. For example a&Ope$G would be accepted in its original form, as well as A&Ope$G and A&oPE$g
eyelidlessness 5y ago
I can only speak to iOS here, but if you focus any field with auto-capitalization and immediately touch “shift” it just switches to lowercase, not caps lock. The only way to engage cruise control[1] is with (timing-configurable) double-tap. 1: https://pics.me.me/caps-lock-cruise-control-for-cool-image-541329-53762267.png https://pics.me.me/caps-lock-cruise-control-for-cool-image-5...

eyelidlessness 5y ago

It’s both a feature and a bug (well, a compromise with associated security risk). The feature is as you describe (and probably mitigates a lot of unnecessary account locks). The bug/compromise is that intentional or automated casing to achieve password complexity is a little bit less effective. I think the benefits of the feature outweigh the security risk, but it should also be widely disseminated, and anything dealing with passwords should take this into account.