Bruce Schneier clearly misunderstood the xkcd scheme. In fact, the Schneier method for generating passwords is probably worse than the xkcd method because a si

Bruce Schneier clearly misunderstood the xkcd scheme. In fact, the Schneier method for generating passwords is probably worse than the xkcd method because a significant percentage of the people who try to use his method will choose a password with low entropy such as "wtpotusio2fampu" (We The People of he United States...) or "igmhaohcr" (I'm gonna make him an offer he can't refuse). All I have to do is crawl the internet and calculate, say, the top 5 million n-grams. The resulting 5 million candidate passwords would be far more likely to match a typical Schneier-based password than a corresponding list of 5 million candidate passwords designed to match an xkcd-based password. The simple rule is this: Don't let users choose a password. They suck at it.