FTC technologist: frequent password changes are the enemy of security

True enough. Any password for a remote site should be 128 bits (22 digits & mixed-case letters are sufficient), and thus need not change, pretty much ever. 172PLIK4PKnkjm1EVd0pQz and wvsH35et6ljj6bd78ngIMd are perfect passwords, and don't need to be rotated.

The only password which should be memorable is the password for one's local password file. There's no real need to change it either, since that just gives someone with access to it more possibilities for success.