Subvocal microphones work (to some extent) by detecting the electrical impulses sent to speech muscles when somebody speaks mentally instead of physically. I wonder if this would work with involuntary recollection - I ask you to think of your password, and even though you won't divulge it to me, the signals for speaking it would leak to my electrodes.

Still mostly science fiction, but plausible.

or just abandoning the notion of passwords entirely