It's much easier for me to remember "Please close the window, I'm cold." then it is for me to remember "XSDJd94*(lo03X.._".
The "horse battery staple" XKCD comes to mind.
In other words, while it's useful from a password complexity standpoint to utilize longer passwords, and while this makes remembering them easier, it doesn't change the fundamental issue that managing many unique passwords is difficult for most people.
This leads to the same general mistakes (that password manager application users don't face):
1. Reusing a password (in this case a better one, but the problem remains)
2. Writing all of their passphrases down somewhere.
In general, I still prefer the use of pass phrases versus passwords, but this still requires a password manager for most people to be able to affect safe password habits.
(Thinking of this grammatically it's also interesting that we still refer to a group of jumbled characters as a pass'word.')
Another interesting strategy, not discussed so far, is everyone in almost all lives and professions has some pool of weird technical names that can be concatenated together for a password. I'm partial to "unpopular yet cool integrated circuit ID codes of the 80s". I thought I invented that idea and was introduced to an old programmer using concatenated library calls from multiple languages (so his passwords were concatenations like a java soundex algo library call followed by some obscure fortran matrix manipulation) My mom knows the long legal names of some obscure real estate cases / judgments / citations / forms.
www.example.com: !ThisIsMyPassword!6eec9b9f
news.foobar.com: !ThisIsMyPassword!9ef61f95
Problems:
- It can be pain to use on a mobile device.
- Some sites limit the length of the password
- Need rules for sites that force you to update your password
*Not my true password nor the rule that I use.