“shoulder surfing” is not the problem. It’s people making videos or live streaming who will risk accidentally exposing password length.