This question already has an answer here:
Password composition rule is being considered as a burden for the users and some experts are recommending the increase in the password length instead of enforcing users to comply with the composition rules.
But my point is that in the absence of any composition rule, user set easy passwords as evident from the analysis of Rockyou database. Easy passwords means common words from the dictionary, names of person and city. Moreover, the passwords are mainly composed of lower case letters.
Theoretically longer passwords (minimum length 16) does provide more security than the passwords created under composition rules (minimum length 8 with lower case, upper case, digit and symbol). But we can't say the same about the 16 length passwords if they are set by the humans. If tomorrow every one starts using longer passwords and a breach like Rockyou happens, then the attacker can learn the strategies behind the creation of longer passwords. The attacker can then create a new dictionary and wait for some hashed database to leak.
So how good is the suggestion of increasing the password length?
The passphrase created by the humans are longer but might be easier to guess. But the randomly generate pass phrase are secure if the words are chosen randomly from the dictionary of reasonable size. Why don't websites assign random passphrase and free users of any composition rules?