Funk Babblings

*ding* Windows doesn't happen to have a modern password scheme.

But, most corporations run Windows (I use *nix, but still a lot of the major companies run on Windows). On top of that due to the proliferation of HyperActive Directory al lot of UNIX accounts now have uid/pwd in AD. Thus if you hack AD, you get all the UNIX passwords too. Ptacek is right, when talking about coding for websites, where your password scheme can be homemade and designed on sense.

As for length, I agree... my PGP passphrase has been in the double digits since I started using it. But even that is just a matter of time and technology. Salted passwords help, no doubt, securing anything important 2-factor is a must at this point, as you said. In fact, the PCI requirements for corporations now include 2-factor authentication.