Quote:
Originally Posted by
Gibonius 
I came to this thread to post this.
A lot of thought goes in to this by security people. Unfortunately, it's not that simple. Using long pass-phrases is still preferable in general, but as users become trained to do it that way, or when companies recommend them as a matter of policy, it's easy to modify the code so that the word becomes the basic unit an algorithm works again instead of a character. When that occurs, the entropy of a password is reduced significantly despite its often significantly longer length.
But ya, l33t speak doesn't fool anyone and it's common knowledge that punctuation and special characters usually come at the end, and capitalization at the beginning, and that out of the entire keyspace, only a bit over 30 characters (32 or 34 i think) are used with much higher frequency than any others.