I think that's totally on the right track, but if people start to do that, chances are that they'll start to create exploitable patterns again (maybe they alrea

I think that's totally on the right track, but if people start to do that, chances are that they'll start to create exploitable patterns again (maybe they already exist, I don't even really keep track of how my password cracking dictionaries are evolving). What I recommend is that people use diceware (http://www.diceware.com http://www.diceware.com) to create a six-word passphrase, which they use to secure a password manager. Then use the password manager to generate random 12-character (alpha+numeric+symbol) passwords for each login.