You could let the system ask the characters of the passwords in random order. It would be a bit of a hassle, but gives some added protection for largish passwords.