I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. I'm interested in data relevant to what a user is able to control with the password itself (so, something like phishing isn't on my radar as much since the vulnerability is the user rather than the string of characters themselves).
So, for a secure password, I'm thinking I'll recommend, in descending order of importance:
- length (brute force)
- uniqueness (reverse brute force, matching username/password of hacked Site A to secure Site B)
- impersonality (guessing based on knowable personal details)
- ease of memorization (indirectly relevant; the first three make a password hard to remember, so you have to decide if you're gonna sacrifice those to remember better or if you're gonna write it down and risk the paper getting stolen)
I have length at the top because 1) research generally cites it as the best and easiest way to make a password safer and 2) in my experience, attacks seems to be en masse/random more than they are targeted for an average end user.
I know there are a ton of caveats; the threat model for a high-level politician's email is different than a teenager's Facebook. Maybe you trust your safe more than your memory. But is there relevant data that answers this question on a high level?
EDIT to rephrase the question:
If I must make a tradeoff in my password strength somewhere (as in, in order to make my password easier to remember, I will either make it shorter or use my birthdate instead of random numbers), which attack should be treated as more likely for the average user of a mainstream web application?