[jere]

>If you literally just use 4 or 5 dictionary words, someone is going to crack it fast. Bad people can write a program to try a kabillion combinations of words and it will run fast.

xkcd uses math and I don't see much wrong with it either. You're use hand waving and anecdotes. You can't just say "it will run fast." Unless computers get infinitely fast, there will always be intractable problems.

And you realize that "lorem ipsum dolor sit amet" is an extremely common phrase, right? It has no relation to the entropy in 4 random dictionary words. The thing about cracking a password is you don't have to know the exact format if what you're grasping at is a bunch of low hanging fruit.