"I agree that XKCD's password strength cartoon of four random words is sound but only for non-fast hashing algorithms like bcrypt" Nobody competent will use md

"I agree that XKCD's password strength cartoon of four random words is sound but only for non-fast hashing algorithms like bcrypt" Nobody competent will use md5 and no hash to store password. And even if you are not competent, most frameworks providing auth will have sane default today. So "correcthorsebatterystaple" is still a very good practice: - if the auth is correctly implemented, it's still the best ratio for price/safety. - if the auth is not, you are fucked in so many ways that you password size is the least of your concern.