I am questioning the common advice given to not use dictionary words in a sentence for a password. For example using "My name is Sue!" as a password. On the websites I host and manage if you don't type that exact string of characters you are not getting in. I've looked at the dictionaires used by some cracking software and they are amazing collections of words. I quickly gave up trying to find a word that wasn't in there, in every written language. So using a Dutch swear word makes for lousy password. But, there were no phrases in there, and even if there were wouldn't the shear number of possible phrases and their permutations simply turn it into another form of brute force attack?
So, why the advise to not use dictionary words in a sentence for a pass phrase?
(soap box)I think IT has done users a disservice by requiring ever more complex and impossible to remember passwords rather than offering the advise to use a passphrase. I'm looking for a reasoned answer why I'm thinking incorrectly and should go back to the common advice.(/soap box)