Some password management applications suggest strong passwords formed by groups of random words stringed together with a simple delimiter. For example:
In contrast, I believe that a suggestion based on groups of four digits is not as noisy (important when trying to read and type the password), easier to support (no need to research and maintain a dictionary), and just as secure in practice. For example:
The alternative shown, is equivalent to stringing four random words extracted from a 10,000-word dictionary to which everyone has access.
As presented, an attacker who is neither lucky nor unlucky would need to check about 158 million guesses per second to crack the password in one year.
Provided that both are generated using a cryptographically-secure RNG and persisted using a strong key derivation function, would you have any reason to prefer a dictionary-based policy over a random-digit policy?