Yes and no. There's been plenty of discussion over at Security.SE on the subject. Let's start with a quote from an answer by Jeff Goldberg:
What the XKCD comic does not effectively communicate is that the selection of words must be (uniformly) random. If you ask humans to pick words at random, you get a heavy bias for concrete nouns. Such biases can and will be exploited.
This right here is probably the single most important strike against the XKCD scheme. Humans are terrible at coming up with anything random . "I flipping love my wonderful dogs and cats" is certainly "long" enough, but is in no way unpredictable.
(As an aside, Jeff also points out that the XKCD scheme isn't actually original to Randall Munroe:
The overall idea for "XKCD-like" passwords goes at least as far back as the S/Key one time passwords from the early 1980s.
The top-voted answer reminds us about the fact that we need to know what we're defending against:
One of the many reasons there is no consistent advice about passwords is it all comes down to an issue of threat modeling. What exactly are you trying to defend against?
For example: are you trying to protect against an attacker who is specifically targeting you and knows your system for generating passwords? Or are you just one of millions of users in some leaked database? Are you defending against GPU based password cracking or just a weak web server? Are you on a host infected with malware?
I think you should assume the attacker knows your exact method of generating passwords and is just targeting you. The xkcd comic assumes in both examples that all the details of the generation are known.
Take a look at this short list. If you fit this profile, then the XKCD scheme is probably right for you:
1. The password will be used in only one place.
2. You care only about keeping honest people and script kiddies out of your account or away from your data.
3. Well... there really isn't a 3.
To put it bluntly, unless you're willing to use Diceware to generate a memorable password, don't bother with the XKCD scheme for anything serious. Troy Hunt analyzed this some time ago. As he says near the end of that post, the "best" password advice is to use fully random passwords and a password manager:
So in total, I’m tracking one hundred and thirty accounts. Very few people will read this and have less than 30 accounts, even if you can’t think of them all off the top of your head right now (can you really remember every account you’ve ever created?) Be honest, add them all up and see what you get to, even the ones you don’t use that often. And if you don’t have 30 accounts now, just how long will it be until you do? Having recently gone through the password management exercise with my father in his 60s and not coming from a technology background, I know that at worst, any regular online user will almost certainly have more accounts than they can count on their fingers and toes and definitely more than they can apply their memory to.
I don't have 130 accounts, but I certainly have more than fingers and toes in my password manager. Every time I change the password to my work computer, it takes me about three weeks of solid usage before I can memorize it. And that's one of maybe 2-4 passwords I actually hand-enter! Try scaling that to 30-100 accounts and it just Simply Doesn't Work.