> An "expensive" hash function like scrypt provides both the user and the attacker the same slowdown/cost multiplier.

Not really. The user only has to wait for the computation once, a few times at most, and it can easily take less time than typing the passwords.

> * Use long secrets (ie. not human-rememberable passwords)

That's very often not the case. Some people like me put truly random passwords on every service. But 99.9% don't.

Also, you can perfectly combine _both_ long keys and expensive hashes.