I wonder what the best convention for generating secure brainwallets is. They seem much more prone to dictionary attacks if you're not careful. Is inventing words and nonsensical phrases the norm?
Well, for one thing, don't use just one round of SHA-256. Or more generally: don't use the same algorithm as everyone else. Chain together different hash functions, and/or run them more than once.