If you are worried about an audio-only attack, step one is to do everything you can to secure your physical premises.
When dealing with keyboard snooping, know that typing cadence could be used; certain keystrokes and "words" are easier to type than others, so typing at a different speed or with a different position of your hands (e.g. rather than home row and touch-typing). This technique is used in certain setups in order to determine who is entering the pass phrase and if there is any possible duress.
To combat key loggers, I suggest using a soft keyboard. Move the soft keyboard’s window around periodically (and don’t put significant chunks of your pass phrase on the clipboard!) As a distraction, have a separate window to enter random text in between segments of your pass phrase (it doesn’t need to accept text; clicking outside the password box on a website should be sufficient). These techniques should also fare decently well against audio-only snooping and passive shoulder-surfing.
Regarding pass phrases that contain backspaces, deletes, and arrow keys, there are ways to make that work favorably as well. Consider a word-based system like correct horse battery staple. This is secure because each word represents about 100k possibilities, so the password has 66 bits of entropy (
log₂(100k⁴)). However, if you manipulate those words into things that are not in dictionaries, your entropy increases. I wrote about how some of these can be calculated in another answer (TL;DR: multiply the number of permutations by 2⁶ once each for: L33t speak, raNdOM case, and errrorz).
Consider this scheme:
- Generate a 4-5 word pass phrase with completely unrelated words
- Press the Home key
- Enter a second password with each character delimited by a prescribed number of → key presses (e.g. 1,1,1,1…; 0,2,0,2…; 1,3,1,3…; 1,2,3,1,2,3…; or even an initial 3 then 1,2,1,2…)
- Repeat the second password until you have reached the end
correct horse battery staple plus the rare word
troubador combine to become
ctorrreoctu hborased boatrte ryt srtaoplue (I started with a left arrow press, moved two characters at a time, and put a space between the two instances of
When computing password entropy, always assume the worst-case scenario: that the attacker knows your password scheme. That means this password’s entropy comes from five words (
100k⁵), times the ~4 options for where to start the final code, times the ~5 options movement patterns, yielding over 87 bits of entropy (
A simpler example using
correct horse battery plus
staple starting immediately and moving three characters at a time becomes
scortrecat hporsle beatt erys with 71 bits of entropy (vs the
correct horse battery staple’s 66).
(This scheme may or may not fool a key logger. Because it messes with your typing patterns, it should fool an acoustic recorder, but I’m not an expert at those; maybe they are sensitive enough to recognize certain common keys?)
Be sure there is no length limit! Word-based passphrases only work with 14+ characters.