It turns out the 10 passwords he 'hacked' were in the range of 1-6 characters.
More details here: http://www.theregister.co.uk/2010/11/18/amazon_cloud_sha_pas...
More details here: http://www.theregister.co.uk/2010/11/18/amazon_cloud_sha_pas...
No.
it doesn't help against a single hash, but for multiple hashes you scale up the amount of work required by the number of salts in use.
But the observation was instead "this attack worked largely because the passwords weren't salted". No, false. This attack set a price of $1.62 per password using the simplest available GPU cluster resource. In no definition of cryptographic security is $1.62 a reasonable threshold.
Scrypt, bcrypt, or PBKDF2 can increase that cost factor to many tens of thousands of dollars per password without incurring appreciable costs to the applications using it.