[marijn]

If you choose a suitably expensive hashing algorithm (I don't know if the author did), brute forcing is not practical.