Quote from: Loophole on April 09, 2014, 03:10:17 PM

To be honest, I don't think the idea illustrated is correct.
Combining a few common words won't give you a great password at all.

It actually will as long as they are RANDOM words. The random is the hard part. Humans are actually very bad at coming up with random values. If you ask people to pick a random number between one and ten a significant portion (usually 20% to 50%) will randomly pick seven and very few will pick one or ten.

Using a true random source like rolling dice is a good method to generate a secure passphrase. Here is an example:
http://world.std.com/~reinhold/diceware.html

These were rolled randomly
chive eat oat puffy crust kiss = 63 bits of entropy (probably better than 99% of the non-random passwords used on this site right now)
chive eat oat puffy crust kiss long = ~80 bits of entropy (strong enough for most applications, roughly the equivalent of 12 digit random alphanumeric (Y22N^56a%$98)
chive edt oat puffy crust kiss long omaha lucky bank = ~128 bits of entropy (considered beyond brute force regardless of the computing power of the attacker)