[johncolanduoni]

That doesn't mean you wouldn't want to be able to brute-force it (in theory). If you're dealing with a data format where you can easily write garbage to a few bytes (e.g. executables) brute forcing would let you find a useful collision.

Of course a hash function that won a NIST competition a few years ago has nothing to fear from bruteforcing via a specialized CPU instruction :P

[wwwv]

If your concern is an attacker that can do 128 bits of work, you've got other problems (like reality).