Adam Katz

@AviD - correct and correct. One could build a password cracker that used logic similar to that of autocomplete to prioritize its dictionary word placements. This would be interesting when paired with password topology examination. My key takeaway from that observation is to ensure you have an obscure password scheme that is secure even if known. Spaces fit that bill right now. I'm particularly fond of a traditional passcode as one of the "words" in a passphrase of words.

@CodeMaverick, I disagree with your math. I count four words of decent complexity plus two words of trivial complexity, which means this is slightly more complex than "correct horse battery staple" (550 years to crack). Always calculate complexity based on worst-case scenario math (e.g. that the password scheme is known). I also agree that, when allowed, spaces and punctuation are great, as there's a high chance that the cracker is not considering them.

@LotusNotes asked about bank password policies. Uğur Gümüşhan noted that IPs could be granted a max number of tries. Billy ONeal noted that a botnet can work around that issue. Most banks will lock any account with a certain number of failed passwords irrespective of the origin of the attempt(s). This is very very very secure, but comes at a high cost: an attacker can lock you out of your account in a matter of seconds.