Originally Posted By: Denis
My understanding of this approach to using long, but easy to remember, passwords (I've had other IT professionals recommend it as well) is that the length alone is what makes password cracking unlikely due to the sheer length of time needed to find the right combination of characters.

I'm assuming that this was already an assumption of yours, but "long" really needs to be combined with some form of "random". Case in point, people may use a snippet of some famous quotation, e.g. "...four score and seven years ago...". Going by length, that's a decent amount of entropy for many situations, in theory, but not the best choice in practice. Password cracking routines can check for famous quotes, and if someone knows you're, say, a history or Civil War buff, then maybe that's something rather easily guessed.

That's the strength of a system like Diceware--it takes the personal bias/preferences out of the equation. You end up with a string of words that don't necessarily have any connection to you at all or any other quote or popular phrase, making it much harder to make educated guesses. Gosh, what was I watching just the other night on TV, where some woman is trying to get access to the "witness protection" database, so she finds a US Marshal at a bar, flirts with him and chats him up for personal info about himself, and then gets into the database by figuring out that his password is his boyhood dog's name, Guiness.

Actually, that's another fine point. That password in the TV show was guessed (by a person). The other way is to do it automatically with some password cracking software. Maybe it's semantics, but software doesn't "guess" passwords, it simply tries a whole bunch of them very, very quickly, usually in some systematic order.