There was a story a few months ago about being able to figure out which keys were pressed by the sound they made. Does anyone know how that story developed? If it was validated then I'm not sure this new attack vector really changes anything.
I can read passwords over someone's shoulder while they're being typed in. However, I usually look away to avoid temptation (University lecturer's root, etc).