There was someone here on HN just the other day that basically decried a scheme for using multiple user accounts to "sandbox" programs as useless because it would be ineffective against "state actors" (aka NSA and their equivalent).
This even though it would likely foil, or at least reduce the impact of "drive by" attacks aimed at accessing personal information for identity theft etc.
"Modern password crackers combine different words from their dictionaries"
And then he goes on to give his advice (of using a password manager or a piece of paper, etc). Is it that advice that you're contradicting?
You also said "..but that's not what is claimed". Are you referring to the implied claim in the original XKCD cartoon (https://xkcd.com/936) or something else? I'm just trying to understand.
But the XKCD cartoon is working on the assumption that this is exactly what the attacker is doing. Despite that, they would have to do more work than to crack the "Tr0ub4dor&3" type password.
I think Schneier just got the wrong end of the stick here. The XKCD reasoning seems valid to me.
There are some issues:
First, what he says is that "password crackers are on to this trick". Knowing the trick doesn't automatically render a scheme ineffectual. If it did, public key crypto wouldn't work (and the proposed scheme for generating passwords wouldn't be any better, anyway).
Second, the article he's citing is an Ars one about the state of the art in password cracking in 2013, which gave a flawed synthesis about the XKCD/diceware scheme based on a misunderstanding of it. Take a look at the list of cracked passwords given as examples, and see if you can find a single one that would have been generated using that scheme.
One of the main takeaways of the Ars article was that the XKCD/diceware scheme is broken. A reference to the XKCD strip is featured prominently in the the main graphic, but the mention of it only shows up on page 3. Examining their methods shows the link from their methods to their conclusion to be a tenuous one. Calling it tenuous is actually being generous, because it's more like a false link. Here's where it gets called out:
Early in the process, Steube couldn't help
remarking when he noticed one of the plains he had
recovered was "momof3g8kids."
[...] Other times, they combine
words from one big dictionary with words from a
smaller one. Steube was able to crack
"momof3g8kids" because he had "momof3g" in his 111
million dict and "8kids" in a smaller dict.
"The combinator attack got it! It's cool," he
said. Then referring to the oft-cited xkcd comic,
he added: "This is an answer to the
batteryhorsestaple thing."
Now some closing remarks about this research in general. When the Ars article was published I waited for someone to call it out, but didn't find anyone doing that. I waited some time to look again and turned up nothing. That is disappointing, but fine, I suppose.
However, the particular way that the security community builds up reverence for individuals and discourages re-examining past results is troubling. When I see how big of an effect the conclusions of one guy and the journalist that wrote about him in a popsci news source have, and when I see that some people have an itch to challenge those conclusions but don't put them out there, I'm reminded respectively of Feynman's motivation to write about cargo cult science and to warn us against the kinds of things that happened with Millikan's results and the oil drop experiment. People shouldn't feel they need to turn away from an argument just because they see those on the other side citing Schneier, and the community needs to do better about not encouraging the growth of unassailable celebrity or creating sacred cows.