Security problems that begin with "the user had a weak password" are strictly the fault of IT nowadays. Every application and gateway should check password complexity and reject passwords on the top 1000 list. If password123 is allowed the IT director should be fired.

Password rejection rules are the primary cause of sticky notes with passwords under the keyboard/on the screen - and they are phishable, loggable, videoable and can be deduced from the keyboard click sounds.

2FA / 3FA is a minimum these days (and can be easier to use than a password)

Keyboard click sounds? I'm gonna need to see some kind of something for that. Sorry, it just sounds like something out of Eagle Eye, like that cup of coffee in that secure room the computer reads the waves on.

It's not a new threat. https://www.berkeley.edu/news/media/releases/2005/09/14_key.... is 16 years old.

Standard rules for (Soviet) embassy staff during the cold war included writing secret documents with a pencil rather than a typewriter because the text might be deducible from the sound of the typing.

Of course the writing would also be done in a box suspended inside another room with white noise generators in the intermediate space, just in case the text might also be deducible from the sound of handwriting.

My source for that might be one of Viktor Suvorov's books.