All the words he is using are in your dictionary but you don't have all the combinations of all the words in your dictionary. If you have "Apple", "Baker", and "Charlie" in your dictionary, it doesn't help with "Apple Baker" or "Apple Charlie".

This misses the point. The comic assumes a dictionary attack - that is to say, not brute-forcing character-by-character but rather word-by-word, whether this is constructed in advance in a static dictionary (possible, for 4 words from 1000; less possible for larger) or generated in a stream (likely more efficient regardless). Cryptographically, it's a dictionary attack - you're confining your search space based on guesses (in this case, we're assuming entirely accurate guesses) about the shape of the password. The point is that in the face of this, it's still more secure than the "variations on a single word" type of password, and can be easily made sufficiently secure for high security tasks (8 words => ~80 bits, and longer lists make it easier still) while remaining comparably memorable.

A dictionary attack uses a pre-built dictionary of (words OR phrases).

A brute force attack takes an input of (characters OR words) and creates a (word OR passphrase) to test.

It doesn't help that you've made this mistake several times in this thread.

Imagine a 4 word diceware phrase.

One attacker has the diceware list of words. The attacker knows we have a 4 word phrase, and so starts kludging different 4 word combinations of the diceware phrase.

This is a bruteforce attack. It is not a dictionary attack.

It's a brute-force attack in word space; it's a dictionary attack in character space - you are picking guesses expected to be more likely.

It is a brute force attack in any space.

Please supply any citation for the use of 'dictionary attack' where the attacker takes a list of words and creates pass phrases from those words.

I don't know why you think otherwise.

> you are picking guesses expected to be more likely.

That's not what defines a dictionary or brute force attack.

No, it is most emphatically not a brute force attack in character space. A brute force attack (as I am sure you know) is exhaustively checking every combination; running through all combinations of characters is a way, way, way bigger search space. Restraining ourselves to looking at word combinations makes the search much more practical (just how practical depends on how much entropy is left).

Anyway, wikipedia says:

"In cryptanalysis and computer security, a dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying likely possibilities, such as words in a dictionary."

What matters is not how the possibilities are stored/generated, but that you have a pool of possibilities that are substantially more likely, that you can guess first. But if you want to argue some technicality, fine. I don't care so much about the particular labels - what is clear is that, if someone generates their password correctly following the directions in the comic, updated appropriately, a dictionary attack of any form is not effective in reducing the search space below ((word list size)^(words in phrase)), which can be fairly secure.

You don't need the word combinations. Dictionary attackswwill do that part for you (a bit like a brute force, but by cycling words instead of characters)