This bank's website* has a login form for their internet banking section. They disable the password field, and display a randomised virtual keyboard under the login form where users must click on the buttons to add characters to the password field.
* I don't know whether I'm allowed to actually link to the bank's website for demonstration purposes, so I'm not doing that. I can add it if it helps.
I think this is terrible because:
- It makes it a lot harder for users to type in their password.
- People looking over their shoulder can easily see what key the cursor is on, and thus undermine the whole point of password obfuscation.
- The restrictions on the password field are client-side and easily to disable.
Is there any good reason to use this kind of technique that perhaps I am missing?