It's not at all about how intelligent the cracking tools are; it's about how unimaginative users tend to be. Let's say the suggestion "use an easy to remember

It's not at all about how intelligent the cracking tools are; it's about how unimaginative users tend to be. Let's say the suggestion "use an easy to remember sentence, rather than a short password" gets around. The actual set of easy-to-remember sentences for a large set of users will include some very good ones, but mostly a small set of simple ones, like "To be or not to be", "Seize the day" and so on. The cracking programs don't need to figure out what those are -- they just need ONE password dump from a site with poor security (easy to find, unfortunately), and the analysis is trivial. The other downside of sentences, though, is that even when the average person picks an easy-to-remember sentence, it's still hard to remember exactly how they wrote it last time (upper-case, all lower, what punctuation?), and for poor typists, think about the chances of making a typo (or just forgetting where they were) while typing out all those little stars....