I think Schneier was assuming here that the user chooses the words himself rather than using a random generator. It's a fair assumption, given that most people

I think Schneier was assuming here that the user chooses the words himself rather than using a random generator. It's a fair assumption, given that most people won't actively seek out tools to help them make up passwords.