Yes, that is good advice. However, there was one discussion we had in one of my classes, which is that rather than brute-force attacks on the password, its often easier to just break the password hash rather than the actual password. I recall a few years ago Hotmail had a similiar password bypass, as did ICQ. And unfortunately, in that case, there is nothing the user can do about it.
Having said that, however, the mere inclusion of a number and/or a special character magnifies the security level of the password by an insane amount. In fact, many brute-force attacks dont even use numbers and special characters, since so many accounts can be cracked with a dictionary list.
I personally advise people to use something they will remember, but to change it up. For example, if you want to use your spouse's name (a really predictible choice, btw), at least modify it- instead of an A use @, an O becomes a zero, and throw in some abnormal capitalizations. 'r0bERT@' is much more secure than 'roberta'.
People generally just dont appreciate how even something easy to remember can become a really strong password.
