This is pretty much why HSMs and good PAKE protocols are important. Key stretching only buys you a degree of computational hardness, whereas not storing or exch

This is pretty much why HSMs and good PAKE protocols are important. Key stretching only buys you a degree of computational hardness, whereas not storing or exchanging password derived material at all makes offline cracking provably hard. Hashing is just a stopgap measure that hopefully gives your users time to do something before they're compromised. It's hard to say how effective it is in practice when a new db dump goes to auction.