Definitely this. There’s this whole thing about password strength requiring special characters and numbers and stuff, which is fine except for two things. One, it makes them harder to remember, and people will tend to abuse the rules.
For instance, the idea behind that is that you’d take a phrase and work in common replacements. Instead, people will end up capitalizing it and throwing on a number and a special character at the end. Take that and put in Password1!, it shows up as strong, and yet it’s about the simplest version you can get. Or if you have longer requirements, something like Password12!@ gets you 100%, but it’s not really doing you any good.
Now let’s look at it mathematically. If you assume alpha-numeric and 35 special characters, you get 97 possibilities, so with a 12 character password, you theoretically get 4.70e104 possible passwords, but as you can see from the above examples, you’re much more likely to get things on the simplest end, and to get something that actually fits the intended complexity, you get something very difficult to remember, so people end up writing it down which, of course, defeats the whole purpose and, as the xkcd comic points out, you end up with a LOT less security that you think you have. That is, you basically have a dictionary attack with a few alternatives like whether or not it’s capitalized and some common trailing bits that fit the requirement and possibly some common replacements. Overall, the dominating factor isn’t all the extra stuff, it’s the dictionary attack.
That’s why the alternative, while theoretically having fewer possibilities, is actually more secure because it’s polynomially larger in the dominating factor, which is the dictionary attack, but using not just one but four words. And if you want to make it even more secure, you can still throw in capitalizations, spaces/punctuation, and maybe a common replacement somewhere.
Either way, when looking at security, it’s foolish to look at it from a naive brute force attack but realize what sort of patterns will fit the minimum requirements and how long those take to break.
As for the actual question in the OP, I’ve used passwords like those on occassion. I’ll use them as default passwords or for accounts where I don’t care if someone gets into it.
Correct. Major X-Phile here. I have used trustno1 but I also use more obscure references that only a really serious X-Phile would ever consider, such as Shiloh.