[wongarsu]

Without salt, meaning the majority of passwords can be reversed with brute-forcing or rainbow tables.

The second google result for rainbow tables lets me download software and tables to efficiently reverse any sha1 whos plaintext fits [a-zA-Z0-9]{1,9} or [a-z0-9]{1,10}. That's likely the majority of passwords an attacker would observe