Hacker News Reader

I'm surprised that Schneier would make such a comment. Entropy is entropy, the "difficulty" estimates already except that attackers are fully aware of the method and the dictionary used.

Schneier is wrong if you are doing Diceware correctly. Schneier is more particularly wrong if you consider the point of the XKCD comic in the first place. What normal human anywhere is doing anything other than incrementing the required integer character (if they are even forced to rotate passwords in the first place)?

I think Schneier was assuming here that the user chooses the words himself rather than using a random generator. It's a fair assumption, given that most people won't actively seek out tools to help them make up passwords.