> The hackers have worked this out too which is why arbitrary composition rules on websites are useless.

Either you stopped reading 1 sentence too early, or you are posting in bad faith to try and smear Troy.

FWIW there are ASICs now that will get orders of magnitude faster hash throughput than your servers.

Edit: I think TFA might be being facitious in the claim "This is a good password because it has lowercase, uppercase, numeric and non-alphanumeric values plus is 8 characters long.", although it doesn't communicate that very clearly.

The immediate answer is that Microsoft built the systems this is discussing last century and at the time this wasn't highlighted. Both the LANMAN and NT schemes are from the era when Microsoft was just getting into stuff like remote authentication that we now take for granted as a baseline.

Even though it's probably true this is an unsatisfying answer because the Unix password hash (at least a decade older) is stronger, using 12-bit salt and a deliberately pessimized hash algorithm.

A further (and longer lived) excuse for Microsoft is that they strongly favour backwards compatibility which has seen their company be very successful over a long period. Having accepted this poor scheme in the 1990s it was hard to give it up and annoy millions of users.

One of the grave mistakes Microsoft made a little later is that they began relying upon these password hashes as secrets themselves, and that's where it starts to get interesting, because that's a sign that key people at Microsoft didn't know that they didn't know what they were doing. That is, not only did Microsoft not have people who were competent to do this properly, they didn't even have people who knew they needed those people.

User PC gets owned, attacker elevates to admin, now has access to IT Support hashes cached locally which can be sent to other devices directly to authenticate.

Obligatory xkcd comic link: https://xkcd.com/936/