I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords can take longer, right?
But it's not necessarily true depending how unaware users can be, and that's where dictionaries shine.
So as the recent XKCD demonstrated, pass phrases are much more secure not because of their bit entropy, but because of their bit length, and even if a pass phrase is done with common words which also are in a dictionary, a dictionary attack of a pass phrase is still "infeasible" if it is at least 3 or 4 words, which makes it still very easy to memorize.
So would it be a good design choice to force users to choose at least 3 words in the dictionary to have a long enough password, for example with some auto-complete feature? What do you think?
PS: I'm asking this not in the context of expensive information requiring design efforts, I'm more thinking into good privacy for public use, considering the attacker has access to the cipher-text (which is not necessarily true on the web).