On: GAZEploit: Remote keystroke inference attack by ga...

[jrockway]

Well, you still only have to try one other password. If you get locked out after one password attempt and nobody knows that you use dvorak, your defense works, but if you have three attempts, you can also add colemak to your list of things to try ;)