Everything you say other than this is true (former MCD shift manager here, but high school was a long time ago, so I may be mis-recalling). The corporation gives you choice of decor from the "catalog" (yes, there is basically a catalog for interiors) and then you split the bill with them 50/50 for the remodeling/upgrade. But they do tell you when you're going to be doing the remodeling and they do hire the contractors. Usually this also includes upgrades of the old/retrofitted kitchen equipment, which is expensive and provided by corporate approved suppliers only.

As others have pointed out above and before: Passphrases are neat and easy to remember --- but a nightmare to type.

There is no functional difference between typing X letters of a word, or X letters of random garbage once memorized. Indeed, I would rather argue that the (almost) random garbage is probably faster, since you could choose it for maximum typing comfort/speed, like more strongly alternating hands for typing and avoiding "distant" key combos, without greatly compromising entropy.

Now, add to this that words in almost all languages follow a nice pattern: Consonants-Vocal-Consonants-Vocal. Usually with a 1.5:1 ratio of consonants to vocals. So your actual entropy for pure word-length compresses down by a similar factor.

So, in difficulty of brute forcing (if the attacker knows you chose either garbage or words) 10 letters of random garbage equal about 15 letters of regular words; give or take a few characters.Add to that the speed argument above, once you've memorized them

This means that a passphrase gets more secure only after it has already become far more time consuming to type.

Finally, at some point (currently at about 10-16 chars, depending on the algorith), it becomes easier to break the password hashes by finding collisions that to brute-force the password.

So congrats for your passphrase having 2000 bits of entropy, when it still only takes 15 minutes to find a SHA1 collision against your password.

Try doing that in an SSH login shell. Or in a textual DBMS management console. Or in a general CLI tool that expects a password. Try it in a computer game that uses its own home-brewn dialog boxes.Or, do it in a text box that does not echo out characters, hiding the length of the password. Or password boxes that disable highlighting entirely.

Now do it, while knowing that you get locked out for 15 minutes when you enter the password wrong once or twice.

There are many situations in which the only way to recover safely from a typo in a password entry field is to hit backspace a few times.

Well played, sir. Well played.