If someone has a really good and valuable reason to be targeting you, they could use this to narrow down a brute force/mask attack.
For normal people, the chances that a password cracker (working for profit) will physically find you and your phone in the real world, be able to listen CLOSELY to you typing in your password AND have your password hash are infinitesimal.
If someone has a real reason to go though a lot of digging just to get YOU, making a seriously large amount of money - more than they'd make cracking someone else's password which is likely to be "12345" and takes less than a minute to crack on a Commodore 64, meaning that they know you're more valuable than the 1234 blonde; you should just turn the key sound off on your phone.
However, if you are this person, you probably already turned the key sound off in iOS9 so nobody could tell how long your password was.
The technical answer is that yes: the loss of security from this is real:
Say your password is "&Passw0rd5"
With iOS9 I would only know your password was 10 characters long (which is way too short but I'm just using for this example to illustrate my point). I would have to assume that you used all 4 ASCII "categories" (uppercase, lowercase, numbers and symbols). This would make your password:
95^10 = 5.98736939E+19 possibles
A seriously badass password cracking computer will check up to 350 billion hashes per second, so this will take slightly less than 5.5 years to crack with brute force (dictionary and other attacks, much faster but that's not the point of the example).
If I had a recording of you typing in you password in iOS10, I would be able to do a mask attack and bring the possibles down to 3.28982945E+15. Which, with the same computer, I could crack this in about 5 hours.
So, there is a very real potential loss of security, but my example assumes:
- You have a very short, weak password that is protecting something very valuable. If your password was 25 characters and very strong, it world still be completely unfeasible to crack it even with this information.
- A seriously pro password cracker wants your password.
- He's gotten the hash of your password and
- He's also found you and was able to be close enough to you to perfectly get the pattern of your password from the sound.
If #1 applies to you, for God's sake, get a secure password. Otherwise, if you're worth going through all the above for, turn the key sound off on your phone and be nice to your private security team so they don't sell you out.
Glad to be of service Mr. President.
If your a normal person, enjoy that cool new feature on your iPhone that will make typing that much more fun.