OK it works! Details:

1. Draw a random rectangle on keypress if listening to password
2. Fill in password as we go
3. Draw little red square if not listening to password
4. Authenticate on password