#2 is less secure, not because of entropy per se., but because it will already be present in existing password test files and/or is trivial to create and test (i.e., JohnTheRipper's ability to generate test candidates based upon patterns).