Lessons learned from cracking 2 million LinkedIn passwords
<i>no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked</i><p>So this is what I've been wondering about the current "best practice" to use long passphrases.  How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language.<p>Would the passphrase "My first car was a 1972 Monte Carlo" really be harder to crack (once the cracking tools are adapted) than a random 8 character password?