It's a probabilistic attack. Of course there are workarounds and doesn't work when people are touch typists and don't look at their keyboards...

Brilliant though, just brilliant.