What you're actually doing there, though, is applying security through statistics. No, an attacker will not know your schema. But she will know all about the c

What you're actually doing there, though, is applying security through statistics. No, an attacker will not know your schema. But she will know all about the common schemas. And you're risking her using your schema in her attacks. Your proposed password is much better than the one XKCD's proposes because you're using uncommon words and punctuation. And I agree, it's more secure.