> and/or stop using a single word and use sentences (phrase)

True.

This isn't meant for the user, though. This is meant for the developers. No matter how hard the developers try, users will always pick bad passwords. If you use salted SHA-1, then if the database gets compromised there goes 50% of the passwords. If, on the other hand, you use bcrypt, maybe only 5% of the passwords get cracked.

Bcrypt turns a massive news event (database leaked; thousands of passwords lost!) in to something much less newsworthy (database leaked; twenty passwords lost).

Not too difficult if it's composed of dictionary words. Why not automatically generate random strings to use? No pattern at all.

Assuming 5 words selected from a dictionary of 234979, there are 716382975036689591261090899 possibilities. If you have 1000 computers each cracking 10 billion attempts per second, you're looking at about 1135817 years. I'm going to call that difficult.

with cuda and the cloud it's quicker to try all possible passwords (starting with aaaaaaa...) than to search a rainbow table of dictionary words so ":Hy6&z@z" is now no more secure than "password"

Rainbow tables don't apply to salted passwords.

But you can still do a brute force attack--that's part of why SHA1 has some issues--you can beat it with brute force and enough GPUs.