if it really works it should not be to hard to overcome this. there will be a different reaction when you see letters of the password you've been actually asked for piling up. so just second session looking for this yet unseen pattern could work.

I think this is quite interesting and would not only work for passwords if it does at all. i would love to read more about this :)