If I understand it correctly, a 4-word password like in XKCD would require about 100,000 rig-years to crack. Do you think that is too low of a safety margin? Or

If I understand it correctly, a 4-word password like in XKCD would require about 100,000 rig-years to crack. Do you think that is too low of a safety margin? Or is the problem that most people's word list may be less than 10K words?