The idea is simply to illustrate the sorts of time involved in guessing someone's password using a brute force attack. If I were attacking hashes then rainbow t

The idea is simply to illustrate the sorts of time involved in guessing someone's password using a brute force attack. If I were attacking hashes then rainbow tables would definitely be my main worry! In this case the main worry is websites (email, banking, etc...) that don't implement rate limiting on their login forms and therefore allow people to make targeted attacks with fairly simple hardware. Because this is out out of the user's control it's very worthwhile choosing a difficult password...