Nothing on Earth is safe and uncrackable, given enough time and compute power. We are living in paranoid. Password and passphrase are theoretically no different

Nothing on Earth is safe and uncrackable, given enough time and compute power. We are living in paranoid. Password and passphrase are theoretically no different. You can generate a password like the one below and you can considered that as a passphrase. "Password" and "Passphrase" are just labels/names. I have passwords which are probably more secured than a passphrase because of length, more use of upper case/lower case/number/special characters. Passphrase (which is supposed to replace the concept of password), should be long and hard to guess, but easier to memorize. Is "bravo multiple Pneumonoultramicroscopicsilicovolcanoconiosis mixture chemistry Gordon Ramsay" a better passphrase? Oh sure. But who the hell would come up with this passphrase? Unique but this is something I made up and I expect myself not able to memorize it even if I know how to spell each word right. Passphrase and password generation by a human is always limited to her own knowledge of things. I just finished playing Battlefield 4 and the random words I am thinking right now are bravo, delta, charlie, because these words are constantly ringing in my ears. I just finished watching Hell Kitchen so Ramsay is on my mind. So there are other channels you can gather what a passphrase is likely to be for a particular user. My point is, advise user what is a good passphrase/password, but don't make them choose totally random words. Reject ones you know are totally weak. It is hard enough to memorize password, so don't sell passphrase like a huge savior while making it look like a password. You ain't helping. That's the conclusion/advise given by the authors. Security hardness all comes down to the strength of the policy. If you allow a plain English passphrase you are weaker, but a requirement to mix upper/lowercase/special char/number? Back to the traditional password. Oh and the greatest insult to password/passphrase security? We don't change passwords/passphrase on every site we register. So you are basically screwed from the beginning. This ain't "update OpenSSL and you mitigate X attack."