This doesn't actually surprise me. If you consider the role of random brute forcing via dictionary attacks is to locate the appropriate order of tokens that wor

This doesn't actually surprise me. If you consider the role of random brute forcing via dictionary attacks is to locate the appropriate order of tokens that work together to create a coherent meaning you're essentially not providing any more security with more words. A "Password" is a phrase composed of tokens that are the alphabet, numbers, symbols. A "Passphrase" is composed of tokens that are known english words. By taking the corpus search method to determine natural phrases they're essentially trying to identify the total breadth of 2+ token combinations that make up the english language. This does break down like they said when you stop using coherent meanings. A passphrase that is HorseQuoteBulb would be hard to guess in comparison to HorsesEatHay or something of the same style. The same goes for passwords: while it may be easy to guess a password as "phrase" it suddenly becomes a lot more difficult to randomly attempt guesses at "7_-Az!e". Eventually I think we'll all be forced to use two factor authentication for added security. Here the user is mostly safe from their own ignorance where the danger of having credentials stolen is more prominent in the form of Man in the Middle attacks.