> But you’re forgetting the massive GPU array. The hacker runs a program that generates random combinations of two, three or four dictionary words and tries it

> But you’re forgetting the massive GPU array. The hacker runs a program that generates random combinations of two, three or four dictionary words and tries it against your password hash. It’s going to take a while because the number of such combinations are very large, but it’s not impossible. The xkcd comic suggests a combination of four from a very modest 2000 (2^11) common words resulting in ca. 2^44 combinations to check. It also assumes 100 guesses/sec which result in over 500 years to break. That's precise math and a somewhat reasonable assumption. You counter this with an argument like "the number of such combinations are very large, but it’s not impossible". You give no new numbers, no counter-assumptions, you don't argue that 100 guesses per second is too slow, you just state this. So in this form your argument is ungrounded.