Let's say, for instance, your friend needs one of your passwords to do something while you're away. He calls you and asks for it. Thing is, you don't want him to know your password.
How then would you allow him to enter said password with only a keyboard and the phone in his hand, without him knowing the password?
Coming from a security background, several options come to mind real quick:
1) Have him enter a one-time password/code/phrase (OTP). (OpenID providers such as any site that supports or provides a "Sign in with ....." use this.) Then delete or change the (normally) 10 passphrase once he has entered this one.
2) Use Oauth or OpenID again, but using QRcodes or pseudo-random gibberish as alluded to by Duncan, only instead of the delete/modify it uses the QR code on his tablet/phone
3) Using a keychain in the browser or OS (assuming multiple accounts -- a couple of dummy accounts), have him select the username in question. The password is hashed out (******), they hit enter, you change promptly.
Answer in parts so people can guess the rest as they go along.
Answer part 1:
Assuming you both have smartphones, have your friend turn the camera on for video chat and close his eyes
Answer part 2:
Then he can hold the phone over the keyboard so you can see the keyboard on your phone through the video chat
Answer part 3:
He randomly places his finger on the keyboard and you direct him to move his finger to the next letter in your password, one letter at a time (I.e. If his finger lands on the "u" and the next letter is a "v" you direct him to go left, down/left, down/left.
requirements:
This requires that you trust your friend to keep his eyes closed and that he does not start on one of the "home" keys, f or j (in a qwerty keyboard) that have little ridges on them for identification. Or that if one of the home keys is in your password, you have him reset his finger afterwards
I'm assuming the main point is that the friend not learn your password, because maybe it is also used for some more sensitive purposees. You could do this for most websites by logging in on your own computer, and then sending (I guess reading aloud, which would take some time) your session credentials to your friend. These are usually stored in a browser cookie.
Friend inserts these session credentials artificially into her browser, and it just looks to the server as though your logged-in laptop just changed IP addresses.
For many sites, this would allow your friend to be logged in as you, and perhaps even change your password, but probably not ever see the actual password.
Have him change the key layout to Dvorak first. Then tell him which letters to type on the normal layout. E.g, if your password is "horse staple", you'd have him type "jso;d ;karpd".
Of course, this relies on him not typing into a text editor, nor remembering the random sequence of letters to translate later.
You could embed your actual password inside some random string and them tell him to type that random string, which you could make as complicated and as long as you want.
For e.g. if your password is abc123 then you could tell him to type, lets say this - gibarisbhc3$%&1st2u5f3.
It really doesn't matter what random string you choose to say, so long as it contains all the characters in your actual password appearing in that same order.
Now its just a matter of making him delete the unwanted characters from that random string such that only your password remains in the password field before he presses the enter key to log in to the machine.
In the e.g. above there are 16 unwanted characters that needs to be removed and lets say we choose the method in which we will remove them starting from the rightmost character. You could also adopt some other complex methods (like for e.g. first odd ones and then even ones) of deleting to make things more complicated, in case your friend has a nearly eidetic memory.
Remember that the cursor would be at the end of the last character before the deletion process starts. I'm saying this because you could actually add more complication by not starting from the end (for instance just tell him to press the Home button which would take the cursor to the start). OK so the first unwanted character that needs to be deleted in our adopted method of deletion would be the last f. This can be done by telling him to press the left arrow once and then hit backspace and so on and so forth for the remaining unwanted characters. So it would be nearly impossible for someone to figure out the actual password, assuming he is not writing the password and is simply typing it as you say it on the phone.
P.S. You could also make use of the Insert key during the deletion process to add one more layer of complication.
Another technique that has not yet been mentioned would be to change your password, give it to your friend, and then change it back after he is done with the task (in most competently designed systems, this should invalidate all current login tokens and therefore kick the user out of the system).
However, all of the above techniques all render your friend (whom you presumably don't want to give full account access) capable of full control over your account, at least for a limited amount of time, in a state where you have no oversight over his/her actions.
One way which prevents these avenues of attack would be to let your friend open a secured VNC tunnel to your computer, which has the account already logged in. This way, you can monitor whatever actions are taken, and be able to disconnect said friend if they attempt to do anything that you do not allow.
You can obfuscate the password using backspaces and arrows. For example, if my password is "Steve", I could tell him to type:
xS{left}{backspace}{right}t... etc. Hopefully you get the idea, I'm too lazy to give a full example!
Of course, if he types it into a plain text field, he would still see the password, so probably go on speaker and use facetime or something to watch as he types it directly into a password field.
To mitigate against someone listening on the line, you could utilize some shared secrets, like "press {left} {your daughter's age} times".
Not the most secure way, but it is possible for them to let you log in via some from of remote desktop connection, and then you type it in somewhere where it hides the characters with * or similar - note that this is would be susceptible to a software keylogger, possibly browsers saving passwords, they would see the length, etc.
But one really usefull idea is create a pression group (aka lobbying) to incentivize big e-mail providers to create one-way (single use, aka disposable) timed (good only for 5 minutes) restricted (only receive or only send up to a limited number e-mails) passwords!
So, you need a friend do access your e-mail account. Ok, give him/her a disposable password that is only good for send/receive e-mail up to the five minutes period with no access to the account settings.
Some one could get rich making things this way :).
Anything else mentioned is a crude adventure to be doomed to failure.
