[jrockway]

I kind of doubt it. People will use the same password on every website, and if you require it to be 4 words, they'll just make it "my password is password" or something. Password requirements don't improve password security. Reuse and phishing are always going to be the main problem.

(Of course, bad passwords are bad. One time I exposed a mysql database I use for local unit tests to the Internet with the credentials root:test. It was hacked in hours, with a message saying where to send bitcoins to get the database back. Slightly stronger passwords do help with that sort of thing.)