It doesn't even add another factor, really. If I can trick you into revealing your password, I can capture your typing pattern at the same time. Same goes for

It doesn't even add another factor, really. If I can trick you into revealing your password, I can capture your typing pattern at the same time. Same goes for snooping or compromising other sites' auth DBs. At best this adds a bit of entropy that you don't need to remember, but it's probably not much, and you can't change it...