Modern password crackers combine different words from their dictionaries But the XKCD cartoon is working on the assumption that this is exactly what the attack

Modern password crackers combine different words from their dictionaries But the XKCD cartoon is working on the assumption that this is exactly what the attacker is doing. Despite that, they would have to do more work than to crack the "Tr0ub4dor&3" type password. I think Schneier just got the wrong end of the stick here. The XKCD reasoning seems valid to me.