I keep reading about situations where a hacker could "easily" brute force a password (most recent example) but I'm confused about when some has an opportunity to do this kind of thing. If it is a website/web service, aren't attempts like this rate limited? I.e. I can't try my Amazon password 50 million times per second, even if my internet connection were more awesome than it is.
What needs to happen for someone to even have the opportunity to brute force their way into a system? And if systems can effectively throttle attempts to dozens or fewer per minute why is there such an emphasis on saying that GPU attacks can generate millions or billions of passwords per second if these are effectively useless?