The "4 common words" password meme was around a lot after that comic. However, such passwords are definitely not secure because a good dictionary attack will break it in hours. You do not have as much entropy as you think with them.
The same problem tangentially applies to his suggested password schema to.
The problem is: as soon as you start using human word or pseudo words then your complexity decreases significantly.
With that said he has a point: password complexity schemas as employed by websites are not good enough. It should enforce length and complexity properly (not by saying "you must have these types of characters" but by really analysing the password).
I appreciate the UX problems involved there... but then we could push people towards using password managers and auto-generated passwords.
Summary: use a password manager and auto-generate complex passwords.
The "4 common words" password meme was around a lot after that comic. However, such passwords are definitely not secure because a good dictionary attack will break it in hours. You do not have as much entropy as you think with them.
The same problem tangentially applies to his suggested password schema to.
The problem is: as soon as you start using human word or pseudo words then your complexity decreases significantly.
With that said he has a point: password complexity schemas as employed by websites are not good enough. It should enforce length and complexity properly (not by saying "you must have these types of characters" but by really analysing the password).
I appreciate the UX problems involved there... but then we could push people towards using password managers and auto-generated passwords.
Summary: use a password manager and auto-generate complex passwords.