It wouldn't be overwhelming to new users if they had examples of what a memorable passphrase is. You'd likely need to disallow specifically using the example passphrase but other than that, I'd be curious to see how well non-technical users respond to an interface asking them for a phrase.
Re: GP. Attackers would just switch to brute-forcing with common phrases. Song lyrics, expressions, etc. Then your passphrase rules will change to accommodate that, and be even more confusing. "The quick brown fox jumps over the lazy dog" and other long, memorable phrases, will be as insecure as "password123".
http://arstechnica.com/business/2012/03/passphrases-only-mar...
>> The "30 bits of security" means the chances of a single guess cracking a four-word passphrase would be one in 230. What's more, the two-word phrases cracked in the study provided just 220.8 (or 20,656/0.0113) bits of security. Another way of expressing the same finding is that a dictionary of slightly less than 21,000 phrases is enough to guess the login credentials that slightly more than 1 percent of people in the real world will use.
To be sure, that's a vast improvement over the security of normal passwords. Analyses of compromised passwords leaked onto the 'Net, including a corpus of 32 million plaintext codes dumped following the 2009 hack of online games provider RockYou, show that it's trivial to crack a sizable proportion of real-world codes. A dictionary of just two of the most common passwords—123456 and 12345 respectively—typically guess 1 percent of login credentials.
In theory, large alphabets and long passwords lead to increased password strength because they mean your password could have been many other things. In practice, the vast majority of those other things were never live possibilities, so the password is not that strong even if it is long or the symbol set is large.
For example, suppose you choose to base your password on your dog's name, Rover. This is one of maybe half a dozen likely choices for you, so is not a strong password. If you modify it for length and symbol set into Fetch4meRover!, this is still one of maybe a dozen things you would have chosen to do with the name, so is still not that strong in spite of the length and character set.
In general, you should not trust yourself to generate random information, and particularly passwords. Use a script to randomly generate a password -- a script with a known large number of live possibilities. This is the only way to ensure those possibilities -- the ones that make a password secure -- were ever actually live.
That is a trade-of because they will write it down and put it next to their monitor.
But then the bad guy has to physically get it and the password isn't going to be used anywhere else so you nuke the two biggest issues with passwords.