If you're not already mitigating the risk of someone *hearing* you type your passwords, you should probably start... It always seemed like a probable risk, but now it's confirmed: