This is mostly speculation, but I see a number of plausible scenarios:

• The article is correct, and NY Times did not salt their passwords;

• They salted them, but used a hashing algorithm not slow enough;

• The attackers targeted a few specific passwords (probably by guessing and/or brute forcing them).

As for your last question, AFAIK the value of salting is to increase the amortized cost of breaking N passwords (i.e. without salting, breaking 1 password or all of them have the same cost; with salting, N passwords cost N times more than 1 password). A rainbow table could be created specifically to target a single account, but the cost of doing so is always greater than just brute forcing it (see @ThomasPornin's comment), so I doubt that's what happened. So I'm guessing you're right in your suspicion that "the reporter was confused about how the hack would likely have occurred".

This is mostly speculation, but I see a number of plausible scenarios:

• The article is correct, and NY Times did not salt their passwords;

• They salted them, but used a hashing algorithm not slow enough;

• The attackers targeted a few specific passwords (probably by guessing and/or brute forcing them).

As for your last question, AFAIK the value of salting is to increase the amortized cost of breaking N passwords (i.e. without salting, breaking 1 password or all of them have the same cost; with salting, N passwords cost N times more than 1 password). A rainbow table could be created specifically to target a single account, but the cost of doing so is always greater than just brute forcing it (see @ThomasPornin's comment), so I doubt that's what happened. So I'm guessing you're right in your suspicion that "the reporter was confused about how the hack would likely have occurred".

This is mostly speculation, but I see a number of plausible scenarios:

• The article is correct, and NY Times did not salt their passwords;

• They salted them, but used a hashing algorithm not slow enough;

• The attackers targeted a few specific passwords (either brute forcing them or building specific rainbow tables for each of them).

As for your last question, AFAIK the value of salting is to increase the amortized cost of breaking N passwords (i.e. without salting, breaking 1 password or all of them have the same cost; with salting, N passwords cost N times more than 1 password). A rainbow table could be created specifically to target a single account, but the cost of doing so is generally greater than just brute forcing it, so I doubt that's what happened. So I'm guessing you're right in your suspicion that "the reporter was confused about how the hack would likely have occurred".

This is mostly speculation, but I see a number of plausible scenarios:

• The article is correct, and NY Times did not salt their passwords;

• They salted them, but used a hashing algorithm not slow enough;

• The attackers targeted a few specific passwords (probably by guessing and/or brute forcing them).

As for your last question, AFAIK the value of salting is to increase the amortized cost of breaking N passwords (i.e. without salting, breaking 1 password or all of them have the same cost; with salting, N passwords cost N times more than 1 password). A rainbow table could be created specifically to target a single account, but the cost of doing so is always greater than just brute forcing it (see @ThomasPornin's comment), so I doubt that's what happened. So I'm guessing you're right in your suspicion that "the reporter was confused about how the hack would likely have occurred".