As with normal passwords, you will have people completely disregarding any advice on how a password should look like. People will just slowly learn that having

As with normal passwords, you will have people completely disregarding any advice on how a password should look like. People will just slowly learn that having a faulty security system on the web is the same as it is in real life. You don't put a curtain as your front door, and you shouldn't put "Harry Potter" as your passphrase, especially if you are holding a wand in your Facebook photo. In my case, I use multi-word passphrases with words from a obscure dialect of a tiny European country's language. Being a dialect I grew up with, it has the benefit of being easy to remember, and the obscureness of it means the phrases itself are more or less a random string of characters to any brute-force attack. Not exactly a "best practice" for anyone but myself, but I'm happy with it :).