It is a long-held belief that security needs to become more prominent in the development lifecycle. Instilling this belief in the developer community, however, has proven to be rather challenging.

As I understand it, modifier keys like Shift, Ctrl, Alt, etc. generate virtual key codes in Java because they don't generate real Unicode characters. And Sun says not to rely on virtual key codes.