I am more of a smoke and lasers person myself. in terms of counter-intuition in this regard: The attacker probably has a lot more awarness of all the possible biasses out there it could leverage, than any user/regular person would. So odds are whenever a user thinks they are clever, they are bound to produce something that is trivial to unravel. Good randomness is not easy per se, but it for sure is dumb, but thats the point; there is nothing to latch onto