> a) the attacker doesn't have your dictionary

How many truly unique sources for dictionaries are there?

My own password generator simply uses `/usr/share/dict/words`, which is not that hard to guess (and documented in the generator's source code).[0]

Add to this that not all languages lend themselves to this algorithm – while my native language is German, you'd need a word stem dictionary, as opposed to a regular dictionary, for this, so I stick to English dictionaries.[1]

[0] I actually made it configurable, but lacking a better source, it'll probably remain at this default: https://github.com/creshal/yspave/blob/master/config.json.ex...

[1] cf. http://creshal.de/News/?id=59 , where I rambled on it a bit more.