The final section of the article about ‘password diversity’[0] is interesting to me; allow me to think aloud for a little bit. Whilst I appreciate the recent s

The final section of the article about ‘password diversity’[0] is interesting to me; allow me to think aloud for a little bit. Whilst I appreciate the recent shift to advising passphrases (and password managers, but that's a different topic) for normal users, the I've noticed that received wisdom tends to be that the words need to be unrelated, i.e. don't use a quote from a book (although I notice that the NCSC's own guidance[1] does not state this). However, surely this would be an acceptable workaround for those who would struggle to remember (or, as you say, conjure up) an assortment of random, sufficiently-complex words? Password diversity would be enhanced if the text-based authentication ecosystem included traditional passwords, random passphrases AND semantically-meaningful sentences, more so than with only the first two? Of course, quotations have their own strength problems (i.e., in a language like English any sentence will contain a lot of 1–3-letter words), and perhaps ‘it was the best of times it was the worst of times’ would just become the new ‘123456’, but perhaps the ecosystem-wide strengthening effect could mitigate those? [0] https://www.ncsc.gov.uk/blog-post/the-logic-behind-three-random-words#section_4 https://www.ncsc.gov.uk/blog-post/the-logic-behind-three-ran... [1] https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/use-a-strong-and-separate-password-for-email https://www.ncsc.gov.uk/collection/top-tips-for-staying-secu...