An important tweak to the "real world" aspect of cracking passwords -- the attacker is just as capable as the user of reading the advice you give to users when

An important tweak to the "real world" aspect of cracking passwords -- the attacker is just as capable as the user of reading the advice you give to users when choosing passwords (and what rules you enforce). If you say "longer is better -- nothing else matters" or "think about using a passphrase -- the added length makes your password much more secure!", and you prevent them from using passwords < 10 characters, that's going to influence the attack.