You need to do it properly; the comic is misleading on its own.

https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

See also: zxcvbn

https://lowe.github.io/tryzxcvbn/

I really, strongly, disagree with the core argument of this post.

His "solution" is to use shorter passwords. The XKCD method is good if you add separators, padding, etc; as expressed featured on xkpasswd.net

I highly recommend generating a password and then adding something unique to it.

For instance, a password I might generate would be:

$66=mine=BODY=spot=STOP=23$-d1j1t

It's memorable enough, and I highly doubt it's easily crackable. Certainly no less than 'tlpw2m'.

Even just //44$random$WORDS$11// is effectively just as safe, in the real world. Especially if you use gibberish words that aren't in any commonly used dictionary.

That blog post does not give any convincing argument against XKCD-style passwords. It seems to incorrectly assume they are "security by obscurity".

Honestly, I had a good laugh until I saw who wrote that. To be fair, I think Bruce is saying that most people will fail to pick truly random words, which is fair.

However, as you point out, it provides no argument against passphrases, aside from referring to them as a "trick". I still don't know how people look at the XKCD explanation (where Randall Munroe actually does a pretty good job of correctly and succinctly detailing the strength of the two password styles [1]), and call it a trick. The only trick is that your mind has an easier time remembering passphrases than it does remembering a similar strength random string.

[1] Specifically, Randall already assumes that the cracker knows that the password is a passphrase, and has the 1000-word list it was picked from.

Those pushed into FUD against XKCD password scheme can simply add more words. All arguments in https://www.explainxkcd.com/wiki/index.php/936:_Password_Str... remain, including the ease of remembering.

You still definitely have to accept at least four words actually randomly generated (this is important, else the scheme falls apart horribly). Accepting 6 random words is pretty secure IMHO.