Could you keylog/model a user when using another machine i.e. a public library computer, then use that model to simulate the user (playback) elsewhere? Do you have to capture them typing the 'passphrase'?
"We examine the problem of keyboard acoustic emanations.
We present a novel attack taking as input a 10-minute sound recording of a user
typing English text using a keyboard, and then recover- ing up to 96% of typed
characters. There is no need for a labeled training recording. Moreover the
recognizer bootstrapped this way can even recognize random text such as
passwords: In our experi- ments, 90% of 5-character random passwords using only
letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-
character passwords can be generated in fewer than 75 attempts.