[flagged]
> A modern consumer GPU can crack "four random English words" in a day
What you're saying now:
> My mid-tier laptop GPU can crack the usual wordlist in under 12 hours against MD5 (46 billion guesses per second)
So your response to the plain mathematical fact that, no, your consumer GPU cannot crack "four random English words" in a day, is that your consumer GPU can crack four words chosen from a list of a few thousand, in a day. Followed by personal attacks. Okay.
Trying to pick a strong password assuming the service you’re signing up for doesn’t care about security is pointless. You’ll be pwned regardless of what you do.
For passwords? Where do you get that information?
Even if only 10% of the services you use use MD5/SHA-256 (although I certainly would expect it to be >50% if we could do a large-scale study), why accept your password being easily compromised 10% of the time?
Those services using md5 aren't doing important things, I hope, so the password for that service hardly matters.
If it does matter, then user long passwords/phrases and rotate every time (or find a better supplier).