[delayed]

Sadly I think security systems will have to accommodate the possibility that someone else can see your screen. And hope that they can't see your keyboard.

What if you're demonstrating a problem with a login screen? And yes, I've had to do exactly that more than once. I wouldn't do it with a particularly sensitive password (online banking etc) but there are enough passwords I use regularly for work purposes where it wouldn't be a significant risk for others to watch me type it in, certainly if the characters aren't revealed at all while typing. Though having password fields be able to detect your screen is being shared automatically and obscure what pixels are relayed would be nice.

Why use a good password while testing your login screen? I use "iamroot" and "password".

They're typically passwords that are only for testing accounts anyway, and that are known to the team members I'm sharing with. But...it's easy to slip up now and then and forget you're actually putting in a password while screen sharing that it's probably best not to have your co-workers know! Obviously the worst is your actual O/S password, as knowing that could potentially allow a co-worker access to other passwords that are quite sensitive, but I'm not sure it's even possible to screen share your O/S login screen - probably shouldn't be! It is a good argument for not re-using that password for any browser-based logins, but SSO policies tend to make that impossible unfortunately. Mind you I use a pin for my O/S login screen, whereas for browser-based logins you can't.

I'm going to suggest that is correct and also unusual behavior.

I don't type passwords. My password manager fills them for me, or I paste them.

Unlocking the password manager means I need to type a master password in while in a public place. Feels higher risk when it is an unimportant website but potentially gives access to all websites. Still better than the passwords being accessible on disk but having individual passwords would reduce the impact of any password leak.

1password uses biometrics on my 7 year old MacBook Pro, so even if I'm out and about I still don't need to type it.

1p works great on my mac but still asks for a password from time to time, I'm not sure of the exact mechanic.

OTOH even Chrome's password manager now integrates with the Mac fingerprint auth.

It's every two weeks. If your threat model involves being spied on over the shoulder for your master password while in a cafe you "just" need to ensure you enter your password in a safe location every two weeks.

I have this InputStick USB dohicky that shows up as a generic USB keyboard when plugged in but is also an encrypted Bluetooth dongle. There's a plugin to Keepass2Android that I use to type passwords from my phone. I use that to unlock my password manager (using a giant untypable passphrase).