I wish when designing a new site people would take into account how frequently a user is likely to log in. If it's going to be something infrequent, it would be better to use OAuth/OpenID or an email/SMS based login. Forcing a user to come up with a password they know they won't be typing often all but ensures they'll use the same password on multiple sites. For example, my side project varmail.me is a site you'd log into maybe once every couple of months, even as an active user. So I made it work by emailing you a login link. I think people defaulting to a user+password auth scheme is part of the problem.