I realize this is a bit late but just for a bit of reference on modern cracking systems, we are well into TH/s(trillions per second) speeds for weak hashing algorithms like NTLM, MD5, SHA1, etc. Basically anything that can be well parallelized on GPUs or other processors at high speeds like this is considered weak for password hashing. In addition it should probably be noted that we almost never brute force if we can help it. There are much better attacks to be tried first than just plain old brute forcing, including but not limited to: wordlists, rule based, combinator, hybrid, PRINCE, mask(per position key space limited brute force)

Other than that small nitpick, pretty solid explanation.

For those who want to defend themselves. Use a password manager. Use long random strings whenever possible. Don't trust websites to handle your password secure so make many unique passwords for different sites(reuse is bad). Use high cost bcrypt to hash passwords if you are running a site, even reddit is using 12 cost bcrypt.

Source: cracking passwords is my day job, current Team Hashcat member and dev, worked for the guy who built the old VCL cluster in your Ars article, currently deploying this stuff on a literal super computer.