This would be awesome, but I feel skeptical of how practical it would be. First, the biggest problem today isn't password quality, it's protecting them. 1) Ha

This would be awesome, but I feel skeptical of how practical it would be. First, the biggest problem today isn't password quality, it's protecting them. 1) Hack the password verification/storage database. If you can do that and recover the user-provided input, who cares what type of data it was? 2) Be the man in the middle. Convince the user to give you their password. No password is immune from being entered into, for example, a false bank website. That said, this type of password input opens up a new set of side-channel password attacks: * What about people who can record the audio of you pressing keys? If you share an office with a co-worker, could he set his cell-phone to record when you enter your "password" a few different times and learn to copy your rhythm? * What about extenuating circumstances? Stress, unfamiliar "password entry" layouts, or personal injuries may cause your "password" entry rhythm to get goofed up (I don't know in detail how resilient these schemes are, but I'm assuming that something as drastic as switching hands would mess it up), so you need a fall-back. If you have a traditional password backup authentication, this scheme simply offers an alternative to passwords and not a replacement of them, so what else do you do? More potential "I can't input my password" problems means that it will be easier for an attacker to con his way through the password work-around process. It's already a weak-point of security infrastructures. It sounds awesome, but might be better suited for covert agents who need to be able to not be capable of giving up a password. Not sure how well it would work as a replacement for passwords in an enterprise or for GMail. (Also, for the curious, at least one of the authors of the original paper is a high-profile cryptography researcher from Stanford. So this paper isn't just another "hey, this might have security uses" after-thought from researchers outside the field.)