10 characters is generally immune to brute force attempts if the passphrase is not weak (not found in any dictionary, leaked password list, or common password database). 4 sentences is probably overkill although I would prefer a single sentence along with some numbers which have meaning to you so it is unlikely to be part of a precomputation database.
Is there a mask or set of rules that you apply when generating a 10 character passphrase?
First off, here is an informative (old but still mostly relevant) article describing password cracking ('recovery' is the politically-correct term) with GPUs and commercially available cracking software:
http://www.tomshardware.com/reviews/password-recovery-gpu,2945.htmlTLDR:
1) At least ten characters in length.
2) Contain at least one upper-case letter
3) Contain at least one lower-case letter
4) Contain at least one special character, such as @ or !
5) Contain at least one number
The idea being to force any brute-force attack to search a large portion of the ASCII space, essentially increasing the 'strength' of each character of your password compared to, say, using lower- and upper- case letters only.
