> if your passwords are becoming muscle memory, isn't it time to change them?
Somehow I feel they're safer in muscle memory than in 'normal' memory. There has been a research project once which stored the password in muscle memory by using some sort of game. It got quite a lot of attention, but I don't remember what it was called or anything...
Passwords in muscle memory are quickly and easily typed on almost any normal keyboard. It's actually harder to type them slowly. Like with phone numbers that you know by heart, you need to recite it from the beginning (without pausing for too long) if someone asks the last five digits. This fast typing makes it harder for onlookers to figure out what it is, although most people are probably able to type quickly enough that you can't make out their password regardless.
But yes, it is impractical at times. On the other hand, what new password can I easily use? It's not that easy to remember a randomly chosen sequence, passphrases are not accepted everywhere (needs digits, or are too long, or...), and it only adds to the list of passwords to try before I can login somewhere.
Right now I have a few classifications for passwords. Unsecure sites (no https, unimportant, or bad storage like LM hashes) get a low-grade password, and the best passwords are used only on extremely high profile websites and accounts (like my e-mail password). When I get more new passwords, I'll have to somehow remember if the account was before or after the switch. That's gonna be messy, and I prefer not to try too many passwords. The website could log invalid logins or even collect passwords, and the connection can usually get intercepted (https is not as widespread as I would like). And there is the problem of getting locked out after too many invalid logins. I have enough passwords and variations that 3 times just aren't always enough attempts.