> easily cracked by brute-forcing concatenations of dictionary words This is probably misleading (and possibly confused). Diceware style passphrases are easil

> easily cracked by brute-forcing concatenations of dictionary words This is probably misleading (and possibly confused). Diceware style passphrases are easily brute forced relative to a random passphrase of the same length but that doesn't mean they're "easily brute forced". Assume your attacker knows how you're constructing your password, estimate the amount of entropy, and be sure it's enough. 44 bits is low for offline attacks, but (as the comic points out) still better than a lot of passwords people use even when they're trying to make a good password and following NIST guidelines. If you use 5 words and draw from a longer list, it's easy to be solidly out of the range that's crackable on modern hardware.