[redxaxder]

When picking a password, you don't just care about the entropy. You also care how far down the password guessing order it is.

People who want to guess a password don't just brute force at random. They use a guessing order that goes through more common classes of password first. So if correct horse battery staple becomes a popular password scheme, these will end up attacked before other password schemes. (See http://www.schneier.com/essay-148.html)

Unless you're going to use a password safe full of nasty passwords, you should pick your passwords using an unpopular method.

[salvadors]

The point is that this approach pushes brute-force guesses out into territory that makes it unlikely anyone will crack it even if they know exactly what scheme you're using.

People seem to be massively underestimating just how long it would take to brute-force four dictionary words in a row.