When keystroke meets password: Attacks and defenses