We define the information content of a password space as the entropy of the probability distribution over that space given by the relative frequencies of the passwords that users actually choose. Information content is the correct measure for describing difficulty of attack, since it determines the optimal choices to be made when trying different possibilities for a password.
High information content renders a password scheme more or less
invulnerable. For example, if users did in fact choose passwords
uniformly from the space of all textual passwords, successful
attacks would be extremely unlikely. What is it that renders such
attacks successful in practice? There are two factors. The first
is that in reality users do not choose their passwords uniformly.
If we assume that the data collected in Klein's study
[12] is representative of the general population, then
users in fact use only 10-8 of the possible passwords 
of the time. Such a distribution is highly peaked, and the
information content of the textual password space is
correspondingly reduced.
However, the fact that users do not pick passwords uniformly is in itself not sufficient to make password guessing attacks successful. The second factor that renders textual passwords vulnerable is that the attacker has significant knowledge of the distribution of user passwords, and can use that knowledge to her advantage. In the case of textual passwords, this knowledge includes information about specific peaks in the distribution (users often choose passwords based on their own name), and information about gross properties (words in the English dictionary are likely to be chosen). Without information about the distribution, an attacker would be no better off than if users were in fact choosing uniformly.
Due to the dependence of the security of a scheme on the passwords that users choose in practice, a new password scheme can not be proven better than an old scheme. Performing trials on subjects in order to learn the distribution of user passwords for a new scheme is impractical for such large sample spaces. In the case of textual passwords, learning the knowledge that attackers routinely use would correspond to trying to learn the English dictionary (among others) given no prior knowledge of the types of letter combinations used in English, by having subjects type in 8-character passwords. In the absence of such objective proof, we present three plausibility arguments that suggest that the DAS scheme is considerably harder to crack than the conventional textual scheme. Two of these are estimates of the information content of the DAS password space, which we argue improves on the information content available with textual passwords. The third argument discusses the effect that lack of knowledge of the distribution of user choices has on an attacker.