Gosh, wow. So many things to comment upon.
Well, just recently I was intending to create an account at Cheaper Than Dirt, and it has nice little ballon help thingies which pop up for the password and confirmation text boxes, saying, 'Please enter a strong password'. Well, I was entering my password into Keepassx, which told me I had 167 bits of entropy, which is quite good, and pasting that into the boxes. It wouldn't let me proceed. I assume there's some validation which was kicking out my password due to an unacceptable character, but it wasn't telling me that, so I assume there's an idiot programmer involved there.
I ran into another site that would let me enter fairly long answers in response to the 'security' questions, but when actually using them, truncated the values. So the compare failed. Again, idiots.
Displaying passwords in cleartext is a bad practice. There are at least two ways for this to be snooped. "Shoulder surfing", where someone physically observes your screen, and Van Eck Phreaking. Well, I don't know whether or how well Van Eck phreaking works on an LCD display, since it originally monitored RF from CRTs. Maybe there's a version that works with LCD too. Wikipedia says so.
Good security relies on multiple layers. Dismissing the need for strong passwords -- actually, it's better to use passphrases -- because someone could use a keystroke logger is not a good idea. For example, a cracker in Estonia is in no position to install a physical keystroke logger. And why should he bother, if people are using easily cracked or guessed passwords.
Those "security" questions? Never answer them with anything other than nonsense phrases. While I understand the intended function, they are a big huge security hole for anyone who uses truthful responses to them. Also, I not that most websites display them as plaintext. Another horrible security practice.
Bruce Schneier recommends using a password tool such as Keepass. I use the X-window version of it, and my master passphrase has very high entropy, and I did keep it written down until I had it memorized. Long phrases you can remember, even if they contain only letters, digits, and spaces, are better than short combinations containing special characters. Most people don't understand how this works, but xkcd has an explanation:
Of course, there's this problem: xkcd: Security
If you run into a site where their password policy doesn't allow embedded spaces, and you really to want to use that site, then refer them to that xkcd comic, and tell them they're idiots. 
Password policies which require changing a password at intervals are just stupid. If the password file hasn't been compromised, there's no reason to change the passwords it holds. And, such policies just encourage people to use poor passwords, to avoid the fatigue of trying to remember the new one every 3 months or whatever.
Also, remember that all security is a tradeoff. What is it you're protecting? My banking passwords are strong. The ones I use to log on to a web forum aren't as strong. I can recall one banking password simply because I've used it so much. What is the risk of exposure? Considering that question will help you place some value on your security and password practices.
Oh, fingerprint readers can be spoofed. Actually, anything can be cracked, given enough time and resources. The question is whether whatever is being protected is worth it.
Also, never, EVER, reveal any password. That's one of the oldest rules in the world of computer security.
