Why is it terrible?

Certainly a passphrase consisting of 4 English words is going to be easier to attack than a password consisting of a similar number of random letters. But as long as you judge a password or passphrase by its information content rather than by its length, xkcd-style passphrases can be just as good as random letters, but are likely to be easier to remember.

Plug: I've written a random passphrase generator, inspired by xkcd's https://xkcd.com/936/ ("correct horse battery staple") that picks random words from a dictionary, subject to requirements you can give on the command line. It optionally tells you how much randomness is contained in the generated passphrase (assuming the attacker knows the parameters you used). Sample output (picking 4 words of 6 to 8 letters):

    $ gen-passphrase -v 4 6 8
    verity nonfat shunted specking
        27405**4
        5.6405e17 possibilities, equivalent to:
        58.97 random bits
        12.55 random lowercase letters
        9.90 random mixed-case alphanumerics
        9.00 random printable ASCII characters

The reported numbers will vary depending on which dictionary you use (/usr/share/dict/words by default). In this case, the dictionary contained 27405 words of 6 to 8 letters.

https://github.com/Keith-S-Thompson/random-passwords

Of course this won't work for sites that restrict the length of a password, or that require special characters.

> Why is it terrible?

Ars Technica published an article a few years ago about password crackers, and one of the subjects they interviewed mentioned the XKCD strip in an offhand remark that was flawed and hinted towards what was probably a poor understanding of the subject matter.

Now whenever the XKCD strip is brought up, people who've been shown the article make an appearance and and talk about the scheme being vulnerable while using the phrase "dictionary attack" in a non-specific sort of way.

That's probably what's going on in the GP comment.

http://arstechnica.com/security/2013/05/how-crackers-make-mi...

Nothing is wrong with a good password manager.

Don't forget having lot's of passwords written down in an office setting is terrible for different reasons. &$RGJL__"LKHF#3fghu seems great until it's an a sticky or notepad file.

I just wish the managers would really manage. Instead of just being a sticky-note substitute, if they'd take passwords out of my way (by automatically providing them when needed, once I'm authenticated to the password manager).