Bsrgvty

Many login screens automatically deactivate the Num Lock key on the keyboard before the user can enter their password. This is extremely frustrating for the user as they involuntarily type their password wrong multiple times before realising the Num Lock key is off.

Several undesirable side effects include:

• Missing the password involuntarily 3 times, thereby locking the system,


• Having a timeout after each missed password attempt, sometimes up to several minutes,


• Frustration when one repeatedly forgets to activate the Num Lock key.

Moreover, I don't see what the reason for this would be from a security viewpoint. It does not enhance the quality of the password nor does it ward off any potential attacker.

So why are very widespread systems still using this extremely frustrating methodology?

Some compact keyboard layouts don't have a numpad, so those keys are mapped to the right-hand side of the letter section:

If NumLock is on, then a user typing the password kill, will actually type 2533. Turning NumLock off will prevent this problem, but of course - it will cause another one for those who do rely on the numpad. Keeping it on or off by default will lead to mode errors - regardless of what initial state is chosen, someone will be surprised by it.

A better solution would be to reflect the state of the NumLock key on the screen, akin to the CapsLock key. This way there are no surprises, as this state indicator is in the users' locus of attention.

An example are Acer Revo computers, distributed with compact wireless keyboards. I installed a fresh OS and set up a password, then successfully "confirmed" it. However, what I thought I was doing was different from what the computer saw me do. This problem only became evident when I attempted to connect to the machine remotely, from a place with a proper keyboard.

Many hours and "this cannot be" statements later, I undersood that NumLock was the culprit.

It's a bad UX practice primarily because the user is not expecting this to happen. Users will attempt to do an action and will not be able to do so.

Many login screens automatically deactivate the Num Lock key on the keyboard before the user can enter their password.

I don't believe that this is true.

It may be that Num Lock happens to be off when at a login screen, but I doubt that the login screen is actively turning it off. That is, it's not intentionally done as some way to enhance security (because it doesn't); it's an artifact of how the rest of the system is designed.

On Windows, whether Num Lock is on or off is a user-specific preference. If you have a multi-user system and one person prefers Num Lock on and another user prefers Num Lock off, what should the behavior be at the login screen when no one is logged in?

If I log out, my preferences should no longer be active. Instead, the "default" user's preferences become active, and those are likely to have Num Lock off because that's the safer default for compact/laptop keyboards. (On Windows, this would be stored in the registry, encoded in HKEY_USERS.DEFAULTControl PanelKeyboardInitialKeyboardIndicators.)