It protects by computing something from the way you type your password as opposed to knowing the actual password.
Edit: This raises an interesting question. Wouldn't it then be possible to use the same algorithms elsewhere on websites to identify who is even anonymously using the site?
I read some research a few years back where they were able to figure out passwords based on the small delays between hitting each key. eg. it takes me 100ms between typing an "s" and an "e", but 150ms between an "s" and an "8". Unfortunately I don't recall any identifying details. But yes, I think it's totally possible to identify people by their typing "gait" just like it is with people's walking gait.
https://www.google.com/ideas/products/password-alert/
It protects by computing something from the way you type your password as opposed to knowing the actual password.
Edit: This raises an interesting question. Wouldn't it then be possible to use the same algorithms elsewhere on websites to identify who is even anonymously using the site?