If you are an attacker and targeting a specific user, then yes - you wouldn't know the password length. However, if you were able to breach LastPass and got a d

If you are an attacker and targeting a specific user, then yes - you wouldn't know the password length. However, if you were able to breach LastPass and got a database containing hundreds of thousands or millions of users, you could safely assume that many would have average-length passwords, with lower entropy than machine-generated passwords. This means that using a combination of rules and dictionary-based attacks could indeed significantly reduce the search space. I think the article also does a good job explaining why the claim that "you're safe because of 100,100 iterations of PBKDF2" is pure marketing BS, and LastPass is either being dishonest or intentionally misleading users. It also made me appreciate even more 1Password's architecture, and a deeper understanding of the (mildly annoying) secret keys. The last paragraph is also great: the point of longer passwords is not as much to protect from a breach on their side, but to protect in case your own machine is breached*. Those are very different threat models, and always worth assessing them separately. Disclaimer: I've been a long time user of 1Password, but the recent breaches indeed got me a bit worried about what would happen if AgileBits were ever in the same situation.