You are right, and this is a major annoyance. In fact this whole business of hashing passwords and choosing ones that are hard to crack via hashing is a completely pointless sham, and constitutes what Schneier calls "security theatre".
Password hashing is irrelevant, except in specific situations: authentication protocols that communicate hashes in the clear (which shouldn't be done), and password databases which store hashes in a way that is world readable, like the classic
/etc/passwd (which isn't done anymore).
In the old days, if you were on a public Unix system with thousands of users, like a machine or farm of machines, providing e-mail accounts for university students, poor passwords were literally cracked left and right. The password file of such a system was a big magnet for cracking, with big payoffs. Of course, such a password file is completely stupid. Any decent Linux distro nowadays puts password hashes into
So, the point is, that if an attacker has access to the hashes, the system in question is either ill-designed (quasi-plaintext network authentication protocols, publicly readable password databases) or it has been compromised to the point that knowledge of your plaintext password is no longer relevant, since the attacker needed admin privileges to obtain the hash.
Still, hashes provide a tiny layer of additional security. And that layer protects those who re-use passwords between sites. If one site is "pwned", so that attackers possess your hashed password, you are in trouble if you used the same password elsewhere and that password is easy to crack.
Ironically, people are more likely to re-use very difficult passwords on multiple sites, because they are hard to remember. Second to that, they are likely to quasi re-use the same difficult password by introducing small variations on it. For instance if the original password is considered strong enough to be acceptable by one system, they will just use it on another system, but change a
1 to a
3 and so on. If attackers crack the password with a
1, they can easily guess the others.
It is much easier to generate and memorize relatively easy passwords, such that they are completely unrelated to each other.
Oh, and if you don't see "HTTPS" in the browser bar, all bets are off! Your randomly-generated, 32 character password is being collected by someone, in the clear.
A password has to be only difficult enough that it cannot be guessed in several naive re-tries (attempted entry via the normal authentication mechanism). Any decently implemented site implements the important security measure of locking an account that has been guessed too many times, so that the legitimate user has to take extra steps to unlock it.
If your password cannot be guessed in a half dozen attempts, and you're able to generate and remember completely different passwords of this type for every site, you are basically okay.
Password creation UI which forces users to concoct convoluted passwords is annoying, counter-productive, and not founded in any rationally conceived security principles, or the correct identification of possible threats.