Another consideration, however, is how exactly someone would be able to tell what the colors are, at least in common use-cases. You seem to be bringing this up

Another consideration, however, is how exactly someone would be able to tell what the colors are, at least in common use-cases. You seem to be bringing this up as an argument that the security concern isn't really that important, that because a snooper wouldn't be able make fine-grained distinctions between colors, the attack is more difficult. First, that's not true, it just means you have to be a little more robust to fuzziness. In your current 3 bar configuration, the subtle differences between the possible exact values of a given single color bar are usually dwarfed by the not subtle differences between the 3. Further, you get an even bigger shift when the next letter gets typed. Second, even if we did grant that point, doesn't it simultaneously undermine the very purpose the tool is trying to serve? If it's hard for an attacker to verify the colors, isn't it equally difficult for the user who is supposed to be using this to check that they've typed their password correctly? It looks cool, I will definitely grant that. But it's just not a good idea, and I really hope I never see it used by any sites I frequent.