Linkbaity title from a PhD student with something to sell: the example cited was entirely correct about password strength, and is something the article author admits is important as it is the underpinning of using password managers.
> Even if we entertained the XKCD comic and started training users to select four random words instead of a complex single-word password, I argue that it would not amount to a significant increase in security.
> People are not very creative and tend to think the same way when choosing passwords.
He also completely strawmans the XKCD example: it's not that you should pick four words yourself, it's that you should use four randomly chosen words (using an RNG/PRNG). In this sense, we're just picking fewer random symbols we have an easier time remembering out of a larger symbol space, but this is functionally equivalent to picking passwords of random characters. That was the point of the XKCD comic - that a random chosen password is stronger than your l33tspeak choice of a word or two.
> This means that we should stop blindly classifying password strength based on the number of bits of entropy3, and should consider first and foremost how dictionary-attack resistant the passwords is.
If you look at the right number of bits of entropy, then you get this property: a lot of entropy in the password means that the subspace of passwords it lives in is large, and that a dictionary probe of the space is unlikely to find it quickly. Dictionary attacks are just a particular form of brute force that prioritizes some kinds of passwords over others. In the case you actually followed the XKCD example, you'd have good resistance to dictionary attacks: your password is randomly placed in a large subfield of possible passwords, and the randomness removes any benefit of guessing particular words over words at random.
He's still sticking to the strawman version of the XKCD comic, and attacking a much weaker idea than was actually presented.
> This means that instead of a password strength meter you should be ensuring that there is no skew in the distribution of passwords. If each password is guaranteed to be unique, the advantage of a statistical guessing attack is greatly reduced.
He even admits that the solution actually proposed by the XKCD comic would mitigate the attacks he's talking about, and only his strawman version doesn't.
The rest of the article is obvious security cliches about password managers and 2FA.
I seriously suggest that this guy stop giving security advice that's wrong and clearly just meant to market his own work.