Cryptographic hash (like md5) with salt are bad.
I didn't read the article, but this could be read in one of two ways:
- MD5, even when salted is bad.
- Salted hashes are bad.
In response to the first one, yes, this is true. MD5 has been proven insecure, and is too fast to be a secure hashing function anyways. Don't use MD5.
As for the second, it's completely wrong. Always salt your hash's. This helps prevent against rainbow table attacks.
It isn't uncommon to break/crack unix shadow files.
This is true, most people choose insecure passwords that are quite easy to break. End of story. The classic security tool for doing this is John the Ripper. Even shadow files that use modern hashes often use algorithms that are too fast to really provide much protection (see below).
To make a password hash I should run it over md5 or whatever hundreds or thousands of times.
This used to be true. The reason for doing this is to make it much slower per password attempt (since you have to run the hashing algorithm a lot). Even with a modern hash like SHA2, it's still often so fast that brute forcing a poorly chosen password can take a matter of days, or even hours.
Modern digest algorithms take this into account, and are designed to be computationally, or memory intensive. Common examples include bcrypt which includes a salt and is designed to be computationally expensive. A newer algorithm, scrypt, has been getting a bit of attention recently for also being memory intensive (making GPU cracking that much more difficult).