Askew70, I follow what you're saying now. If I can paraphrase.
"Asking for the same characters every time before a successful login sequence has been fully completed exposes the password stage of the login sequence to an over the shoulder attack."
This weakness is highlighted under the present circumstances where users aren't managing to log all the way in.
That is exactly it. One thing that I am not sure of is whether the characters asked for were any more random before this situation arose. I certainly recall being asked for the same characters in a row on more than one occasion, but I have no recollection of whether that was a regular occurence.
Asking for random characters each and every time would prevent this and make it not significantly more vulnerable to ease dropping (inc electronic) than it already is. A small risk is also created however. With repeated failure to complete login sequences, where correct password details are being entered, over a short period (e.g. a day) of time an ease dropper could more quickly build up a record of all the password's characters. Under normal circumstances the user would not be logging in so much so an ease dropper mightn't have time to record all the digits. The risk of this is very low because the communication is encrypted.
The link being encrypted makes a big difference certainly, but that only protects against people monitoring/sniffing your traffic somewhere on the network(s) between your PC and the server. The risk of someone looking over your shoulder, or of malicious software installed on your computer recording what you type at the keyboard, remains. You can take some simple steps to protect against those, but that risk is always there when authentication relies on information which does not change from one login session to the next (i.e. passwords). There are hardware tokens that generate psuedo-random codes that you can use to authenticate, which are a good, typically expensive but still not perfect, approach to getting round this problem - what Rabodirect use is one example of this.
Asking for random portions of a password is a reasonable, and relatively simple, approach to defeating people looking over your shoulder (or recording what you type at the keyboard) too, by the way. For a criminal to circumvent this security, they'd need to know not only what you typed at the prompt, but also what characters the prompt asked you for (whether the 5th character, etc.) - otherwise even if they eventually record all characters in your password, they won't know the correct position for each of those characters, so they still have to guess which one is, say, the 5th character when prompted for it. This makes it more difficult for malicious software recording what you type at the keyboard, in particular. Of course, it is only of use when you really are prompted for different characters each time i.e. it is all dependent upon that random element in what you are prompted to enter.