Having even a 4KB salt doesn't help: if the hash is too fast, the attacker has time to dictionary attack each user individually, without precomputing any rainbo

Having even a 4KB salt doesn't help: if the hash is too fast, the attacker has time to dictionary attack each user individually, without precomputing any rainbow tables. Hardware assists (e.g. GPU-based parllel processing) can cut the time down to O(minutes) [edit: or O(seconds), see below] per user.