This is a really terrible article. there is no context given at all. If we assume the hacker has access to the hash then we can assume he is using rainbow tables which would result in much better results. Most sites don't permit remote brute force as accounts get locked out after 5-10 wrong attempts...
The Problem with Passwords - BusinessWeek
These numbers are way off. No hacker is gonig to randomly try to guess a password. Heck, anyone can download ophcrack and grab any unencrypted letters/numbers password under 14 characters in about 2 minutes.
