Amid all the discussion about password length vs. complexity (summarized by the famous xkcd strip and the followup dicussion) I am trying to make up my mind about passphrases made up with dictionnary words.
I understand the various calculations for brute force attacks -- would you know of a reasonable study about passphrases which would be made from dictionnary words?
I was namely wondering about a policy with a minimal length of, say, 13 characters - all lowercase. I expect to end up with phrases like
volleyballisfantastic. This is 3 words. If the phrase is in English or French, they would average at about 4 words.
Since one of the reasons to move to a passphrase would be to go away on some systems from throttling mechanisms (lock the account for 10 min after a failed login or exponentially change the time in between login prompts), I wonder if dictionnary attacks would not be way more successful on such passphrases.
Thanks for the thoughts or pointers to existing studies (I googled around and what I found are discussions about pure bruteforce).