I think the real reason that people don't use pass phrases is those damned password/phrase masking "bullets" that make you type blind. If I'm only typing a word, or a word plus a digit/symbol, I can deal with the bullet obfuscation. But when you start to go onto multiple words or sentences it's just too much. Hell, I can barely type a few sentences correctly when I *can* see the words (how many times do you go back and correct errors without thinking about it?), take away that ability and the chance of errors - real or perceived - goes up. If you really want people to use pass phrases, get rid of the stupid password-masking bullets, as Jakob Nielsen said here in "Stop Password Masking" http://www.useit.com/alertbox/passwords.html

The URL to Thomas Ptacek's post is broken :(