The issue is practicality. Which is why pbkdf2 (and increasing the rounds each year) + bcrypt or scrypt is still a better option.

Noob question, but why would you use both pbkdf2 and bcrypt/scrypt? Aren't they all basically doing the same thing?

Bcrypt is an algorithm which bundles up something which pbkdf2 achieves by iterating other algorithms. They're basically the same, but you should use bcrypt. You shouldn't use both of them, I'm guessing the poster above meant / rather than +. If you want more security, increase your (b|s)crypt work factor.

If for some reason you can't bring the bcrypt code into your project, you can implement pbkdf2 using basically a loop and your stdlib's hash functions.

Scrypt takes the whole concept of placing extra demands on the computer and applies it to the RAM rather than the CPU (perhaps as well as?,) the idea being that RAM is harder to accumulate in obscene quantities than CPU power.

That's why the Blowfish algorithm is the best choice for password hashing.

The algorithm uses CPU cycles to generate the hash. So there is no way to speed it up, just by using a faster computer.

A faster computer does speed it up. It can go through all the cycles faster.

An even better option is scrypt, which is memory based, which is much harder to scale.

Which is why passwords just shouldn't be stored with simple hash functions. Even a naïve salt+iteration method would have drastically slowed the attack.

Right.

Using MD5 hashes was done as a relaxing constraint -- at the other end, the attackers had tightened constraints by getting limited time and computing power.

The goal was to show how attackers work and think.