I think the concept of a "strong" password is a bit overrated. Yes, a long, hard to remember alphanumeric string is pretty secure. You won't be able to hack my site just by guessing my password. But this kind of password is also hard to remember, so many users are tempted to either use the same "strong" password for everything, or outsource remembering their password to a 3rd party system.

If you use the same password for everything, one website being hacked can open you up to problems. If you outsource to a 3rd party, once again one site being hacked opens you up to problems.

I know it's a comic ... but the advice on http://xkcd.com/936/ is the best I've seen yet for creating truly secure (but still user-friendly) passwords.