[nshepperd]

> For the few passwords they do need to memorize, you should focus on making them dictionary-attack resistant, not just strong from an information theory perspective.

Information theory is exactly how you measure attack resistance (dictionary- and otherwise). The entropy measure in the XKCD comic already takes into account dictionary attacks. That's the point.