Your last quote deserves a thousand upvotes.

I'd say that we can the cake and eat it too: just generate a random password for the user, show it to him, and ask to not use it if anyone could have saw it when it was shown.

@AviD: we're talking about 4 words in English (or user's native language). Remembering them is easy compared to 8 totally random characters. Even if users use only every eighth password (selecting easier to remember combinations) we loose just 3 bits of entropy while gaining 16.

For an in-depth analysis of the maths behind the xkcd, see Thomas's answer below. His answer shows why the xkcd got the math right, a perfect complement to why it doesn't actually matter.

"Those who would give up Usability to purchase a little Temporary Safety, deserve neither Usability nor Safety." -Benjamin Franklin

@AviD: Do you mind if I quote your answer in material I'm developing on good passwords for a computer security class? Just slides, not for publication.

@Paul Please do! I would ask that you include attribution (link back to here), and if relevant make sure to get the name right: "AviD's Rule of Usability". :-)

@trav1s "The problem with quotes on the internet is that they are so often misattributed." -Abraham Lincoln

It's been a few years I combine the xkcd "four easy to remember words" (i actually use two unix commands changing each two three months), with making the md5 sum of it (protecting from keyloggers because i copy&paste). It is only that many silly pasword validators won't accept 32 char long password.

@AviD - To crack the password of The AviD Rule of Usable Security, it would take 162 decillion or (162,736,703,280,763,400,000,000,000,000,000,000) years with the world's fastest supercomputer at 33,860 trillion calculations per second compared to a tredecillion or (1,377,566,193,271,662,300,000,000,000,000,000,000,000,000) years on a Desktop PC. I think it's safe to say in a Charlie Sheen voice, "Phrases with spaces = Winning!"

@CodeMaverick, I disagree with your math. I count four words of decent complexity plus two words of trivial complexity, which means this is slightly more complex than "correct horse battery staple" (550 years to crack). Always calculate complexity based on worst-case scenario math (e.g. that the password scheme is known). I also agree that, when allowed, spaces and punctuation are great, as there's a high chance that the cracker is not considering them.

@AdamKatz actually, since those are not independent words, but a complete phrase, you cant calculate the entropy for each word individually. (I mean, you can, but that is not the worst case as you said.) So it would be even substantially less (though I'm not sure how to calculate entropy for a phrase...)

Also re spaces and punctuation, if the password scheme is known then the attacker would be considering them...

@AviD - correct and correct. One could build a password cracker that used logic similar to that of autocomplete to prioritize its dictionary word placements. This would be interesting when paired with password topology examination. My key takeaway from that observation is to ensure you have an obscure password scheme that is secure even if known. Spaces fit that bill right now. I'm particularly fond of a traditional passcode as one of the "words" in a passphrase of words.

Like Intel Puts it...

@Sheharyar That Intel vid still misses the point, for pure strength its not just complexity OR length, it's entropy. But more importantly, a good password scheme is NOT just about strength, memorability is equally important - and that's where xckd's passphrases come in, providing both memorability AND entropy.

"Those that would give up liberty for safety deserve and will have neither." -- Melding of Jefferson and Franklin. Forcing users to "be super-duper secure" will instead make users leave because they're tired of all the security checks. Look at airlines. Some tolerate that crap. Others decide to travel by ground.

@killermist right, which is kinda the point of the comic, and my eponymous Rule (and my answer in general). As I often say, "Unusable security isn't (used)".

@AlexisDufrenoy that's one of the reasons to use a password manager. Most let you generate a strong password you can copy and paste, and save the same for auto-filling on forms or making it easy to spell but still random.