> imagine that OP is reusing passwords

FWIW that's impossible in this context since:

> you cannot set app passwords yourself

Though more generally, password reuse is indeed a problem regardless of entropy.

Not impossible: you could get the application specific password and then start using it on other sites.

That would be foolish, but users do all sorts of foolish things.

When data leak occurs, nobody's going to brute force random passwords. They'll use dictionary attacks. Using SHA-256 is strange. Some websites store clear text passwords. Some websites store bcrypt hashes. Why do you focus on SHA-256? Is there some kind of statistics that this particular kind of hash is common among hacked websites?

I agree that it depends on attack scenario. My scenario is: I expect website owners to find out about attack in a timely manner and disable all compromised accounts. Of course I won't reuse single password across different websites. Also I feel that most important websites nowadays require SMS or E-mail factor when logging in from another device, so this further decreases requirements for strong password.

And, of course, I don't expect to be targeted by government. They'll just hit my head with wrench until I unlock my iPhone, that would be cheapest attack on me, independent on password length.

> When data leak occurs, nobody's going to brute force random passwords.

People will absolutely bruteforce random passwords. There are entire communities (like hashmob net, not sure if I am allowed to link it directly) devoted to cracking as many hashes of breaches as possible. Dictionary attacks will get you most of the easy passwords, but are quickly exhausted.

> Why do you focus on SHA-256?

I chose this hash because, thanks to Bitcoin, we know how fast specialized hardware to compute that hash can be.

> Is there some kind of statistics that this particular kind of hash is common among hacked websites?

It's not the most common. That would sadly be MD5. But SHA-256 is not rare either.

> They'll just hit my head with wrench until I unlock my iPhone, that would be cheapest attack on me, independent on password length.

I agree, rubber-hose cryptanalysis can be very cost-efficient. https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis Fortunately, many governments are opposed to this kind of cryptanalysis, but YMMV.

The NSA already has full access to google’s data centers. If they want your password they’ll just sniff it in-flight.

https://www.zdnet.com/article/google-the-nsa-and-the-need-fo...

Since 2013, Google has switched to encrypting in transit across unsecured fiber: https://cloud.google.com/docs/security/encryption-in-transit...

They don't get the benefit of the doubt. I've lost count of how many times these agencies have been caught illegally spying only to apologize and keep doing it in secret. There's probably even a Wikipedia page of all the whistleblowers.

Even if they don’t have free reign over every bit of data (unlikely), there are certainly automated systems that will give them free access to any account they wish upon delivery of a rubber stamped “warrant”, signed by an anonymous “judge” in a secret court.

Don't even need that, just an emergency data request sent from a compromised municipal police email account.

1)https://krebsonsecurity.com/tag/emergency-data-request/ 2)https://news.ycombinator.com/item?id=30842757

> There's probably even a Wikipedia page of all the whistleblowers.

This list does exist.

https://en.wikipedia.org/wiki/Global_surveillance_whistleblo...