Now this is something which i don't understand. Is this really the best we got? If you somehow get into a server with those hashed passwords, you'll probably t

Now this is something which i don't understand. Is this really the best we got? If you somehow get into a server with those hashed passwords, you'll probably try to mirror it and everything on the server, to figure out the hashing mechanism. So lets say, time is not an issue, also regarding long lasting APT's. So what will you do with it? Why should you try brute force a million passwords, each one taking 2 hours to decrypt? No, you're smarter than that: Why not create a rainbow table of possible admin account, vips, state actor, etc. How many are those? 100? 1000? Nice, you just reduced the search space by a factor of 1000. That whole circus about hashing... I know, randomly salted hashing makes sense, but true secure password storage is a myth.