[dmfdmf]

Or put them on a yellow sticky under their mouse pad.

[guelo]

A sticky note is very secure against remote attackers.

[benchaney]

Which is good enough in most cases. If an attack can walk in and physically tamper with you computer peripherals you generally have bigger problems.

[hackuser]

As a very general rule, most attackers are insiders.

[user5994461]

Insiders are easier to identify and deal with. Be it a rogue employee or a nasty sister.

[mulmen]

There is no password policy that protects against rubber hose cryptanalysis.

[e12e]

Sure there is. I believe the classical approach is cyanide in a false tooth.

[AstralStorm]

A less classical is divulging a self destruct/lockout password.

Pity so few systems support this.

[jon-wood]

That's going to go badly for you the moment the attackers realise what you've done. Admittedly they'll no longer be able to compromise the account, but you better really care about that.

[inopinatus]

How about ... a duress code that diverts to a system that looks like the real one but actually contains disinformation (possibly including a misdirection that makes them think you were on their side all along, so that they let you go)

[nkristoffersen]

related: https://xkcd.com/538/