I really wonder how dictionary attacks will progress as word frequency and distribution is studied. "this is fun" has 11 characters, which has 310^15 possible l

I really wonder how dictionary attacks will progress as word frequency and distribution is studied. "this is fun" has 11 characters, which has 310^15 possible lower-case combinations, and (using the 500,000 word dictionary), has 1.2510^17 combinations, an order of magnitude more. But, assuming a smart hash cracker, the size of the dictionary could be shrunk considerably. I believe most people use approximately 10,000 common English words (not including proper nouns or fictional words). 'this', 'is', and 'fun' would all show up under that scheme. Using a 10,000 word dictionary, there are only 1*10^12 combinations. Much less secure than an 11 character random password. A smarter cracker could apply sentence structure rules to skip odd, fragmented sentences (ie. "dog foot with happy"). Also, the article failed to mention the risks of compromised password databases. Sure, the attacker could just gain access to the actual files he or she wants while bypassing the login step, but the list of username/email and password credentials are a major threat to users. Most users only have a handful of passwords, and an attacker could leverage the one they know to find the ones they don't. Password managers are necessary for this reason, to provide unique passwords to each protected site. If password managers become wide spread, then why not let them remember arbitrarily long and complex passwords. It can't hurt, right?