Ok I'm missing the point. I don't understand why the passphrase is wrong to use. It seems to me that the passphrase would be hard to guess. There might be ways to shorten the guessing but it would still years to break. How is this wrong?
It's not wrong to use. Its wrong to codify it or enact it as policy because what a corporate security goons published "password requirements" is really just "search space reducers" For example; not wasting my time on guesses below the 8 char minimum. Thanks security guy, that saved a BUNCH of time!
No it didn’t. I saved a ridiculously negligible amount of time to attackers while preventing users to pick really weak passwords.
In practice few people are going to remember how to spell words like "aceanthrenequinone" correctly so the practical dictionary size is a lot smaller, but still in the tens of thousands of possible words. The xkcd comic says 44 bits for a 4-word combination of common words.
No it doesn't. And that's a really important point on while length matters for complexity. Assuming upper case, lower case, digits and symbols it takes ~1% of your time to try all of the passwords of length 1-7 chars as it does to try only the passwords of exactly 8 chars.