For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a lower entropy than passwords given their nature.
Here is my logic. From my Google based research most blog type posts that a typical computer user might read hailed passphrases as amazing secure thing and even one site claimed that existing password cracking software is incapable of cracking passphrases as they are too long. Taken literally this is true but a simple change in the dictionaries that feed your password cracker can fix that. Never the less, here is my logic:
Users are now somewhat used to the idea that passwords must be complicated, using symbol and number substitution and in length. I personally use passwords based on un-common dictionary words with symbol substitutions and random numbers. Technically, a user who picks a 8 character password (at random) would have a password entropy of 94^8. Granted most people do not have truly random passwords but I will explain why I think this will cancel out with a similar human error in passphrases shortly. That is a crazy huge number since 94^8 = 6.1 x 10^15.
Everywhere and everyone I have seen talk about passphrases have consistently given examples of all lower case, no symbol or number phrases such as the classic xkcd strip with "correct horse battery staple". According to Oxford Dictionary here there is approximately 170 000 words currently utilized in the English dictionary. Assuming users pick on average a three word passphrase (any longer seems to exceed user laziness), that is an entropy of 170000^3 = 4.9 x 10^15 which is roughly 20% lower entropy than the 8 character randomly chosen password. Now, before you argue that no one uses randomly generated passwords, it will be equally rare people choose totally random words from the English dictionary. Instead, users will frequently use common sayings. Even if people avoid common sayings, I am no linguistics expert but there is limited options that can logically follow a word in the English language, seriously cutting down the possible permutations used in passphrases.
With that in mind, I argue that at the very least the failure to comply with randomness in passphrases will equal if not exceed the failure to comply with randomness in password creation as users are lulled into a false sense of safety with the concept of passphrases.
So I present my formal question, am I overlooking some key consideration here or am I correct and passphrases really are less secure if not only equally as secure as passwords and are not some revolutionary new way to make your password/passphrase much more difficult to guess?