They could give feedback about key presses without giving away the password length quite easily