Randomness can decrease your security

First of all many people have mentioned before that a keyboard sniffer can also sniff mouse clicks and hence it can be determined when a user clicks away or to the password field. This however can be easily solved by just clicking with the mouse after every character that is entered.

However a second problem with their method exists. This problem has to do with their use of random data between password characters. When we can sniff more than one session in which the user has to enter the password. We can filter out this randomness. I.e. lets assume that a user typs pfadsos.wromredu in the first session and ptabsescwyotrudw in the second session it is relatively easy to spot that the password is password. Although the analysis required, will be more difficult in a real-life situation it is certainly not impossible. How more sessions can be sniffed, how easier the analysis will become. Just a matter of creating graphs with which letter can reasonably follow which letter.

The solution to the second problem is however simple. Do not use random characters. If you always type the password posswerd as p>oaonesidisleowitooejerdud. With of course mouse clicks between each letter. There is no way statistical analysis can filter your password out of it. In short, sometimes using random data decreases your security.