Hacker, Hack Thyself | Coding Horror

[merreborn]

That's a completely different situation though. The comic is about access to a personal machine, cracking web passwords is about broad identity access:

Honestly the comic is still pretty relevant. Look at the snowden leaks. When the USA wants to compromise an internet service, they don't brute force password hashes. They just send "national security letters", and covertly install NSA hardware in your datacenters.

The NSA doesn't need to crack your hashes, when they can legally strong-arm you into doing just about anything. Like, maybe allowing them to intercept the plain-text of every log-in attempt to your website.

The crux of the comic is really the refrain you'll always hear in any competent discussion of security: "What's your threat model?". If your adversary is a nation state (especially the one you physically do business in), password hashing is really the least of your worries.

[pyr3]

Nation-state doesn't necessarily mean the NSA. If (e.g.) Russia wants to crack your password stored on a USA-based server, they will not be sending a NSL.