But technically you could try a dictionary-based brute-force attack on a user with a weak password and crack it regardless of the hashing scheme.