This article is missing a bunch of facts, namely that NTLM passwords have been broken for 2 to 3 years long before the invention of cheap GPUs. Rainbow tables a

This article is missing a bunch of facts, namely that NTLM passwords have been broken for 2 to 3 years long before the invention of cheap GPUs. Rainbow tables are a far more effective way to attack NTLM hashes. Cracking passwords is trivially parallelizable, if you let your hashes fall into the hands of the enemy then it's only a matter of money. The fundamental issue is that of salting combined with not disclosing your password database. If you're using Windows you should enable the options for SSHA and disable the NTLM / LM hashes. Instead of using a password use a passphrase. I use 3 levels of password and at the top level you're looking at ~22 characters which contains characters outside the normal ASCII range so an attack is looking at ~65536 combinations instead of ~256. I doubt many attackers include the snowman character. :) (and no that char isnt in my password) Running the math quickly yields a time to crack in excess of the lifetime of the universe, it would probably be easier to generate a hash collision than crack the password.